IPv6: disabled Privacy Extensions in dhcpcd.conf not respected

Question

I just fired up my Raspi 3B+ again for a little server reachable from the internet via IPv6. I installed the latest Raspberry Pi Os Lite Version using the Raspberry Pi Imager: It installed Raspbian GNU/Linux OS Version 10 (Buster), 32bit.

When I looked at the per DHCP assigned addresses, I noticed, that my Raspi has two IPv6 addresses:

pi@XXX-Box:/etc $ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:39:bb:ec brd ff:ff:ff:ff:ff:ff
    inet 192.168.X.13/24 brd 192.168.X.255 scope global dynamic noprefixroute eth0
       valid_lft 862050sec preferred_lft 754050sec
    inet 172.16.X.1/30 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 XXX:90X:XXX:5cXX:98e1:XXXX:XXXX:XXXX/128 scope global dynamic noprefixroute
       valid_lft 7046sec preferred_lft 3446sec
    inet6 XXX:90X:XXX:5cXX:ba27:XXXX:XXXX:XXXX/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 6853sec preferred_lft 3253sec
    inet6 fe80::ba27:XXXX:XXXX:XXXX/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether b8:27:eb:6c:ee:b9 brd ff:ff:ff:ff:ff:ff

The /64 scope IPv6 address with 'mngtmpaddr' corresponds to my MAC address. I assume that the IPv6 address before is a randomly generated address due to enabled IPv6 Privacy Extensions. In order for my new server to work, I just wanted to disable these Privacy Extensions.

According to this fairly recent Explanation I need to change the settings in the file /etc/dhcpcd.conf from slaac private to slaac hwaddr. So I edited this file using sudo nano /etc/dhcpcd.conf, disabled private and enabled hwaddr. Then I checked, that the file was actually changed. Here is the file:

# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.

# Allow users of this group to interact with dhcpcd via the control socket.
#controlgroup wheel

# Inform the DHCP server of our hostname for DDNS.
hostname

# Use the hardware address of the interface for the Client ID.
clientid
# or
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
# Some non-RFC compliant DHCP servers do not reply with this set.
# In this case, comment out duid and enable clientid above.
#duid

# Persist interface configuration when dhcpcd exits.
persistent

# Rapid commit support.
# Safe to enable by default because it requires the equivalent option set
# on the server to actually work.
option rapid_commit

# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
# Respect the network MTU. This is applied to DHCP routes.
option interface_mtu

# Most distributions have NTP support.
#option ntp_servers

# A ServerID is required by RFC2131.
require dhcp_server_identifier

# Generate SLAAC address using the Hardware Address of the interface
slaac hwaddr
# OR generate Stable Private IPv6 Addresses based from the DUID
##slaac private

# Example static IP configuration:
#interface eth0
#static ip_address=192.168.0.10/24
#static ip6_address=fd51:42f8:caae:d92e::ff/64
#static routers=192.168.0.1
#static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1

Unfortunately, after restart, I still get the above two IPv6 addresses!

I tried it several times, every time with a restart to see, if the settings stick. Unfortunately, it did not. So, I checked, if my Raspi was actually using DHCPCD by issuing sudo service dhcpcd status. If you look at the result, it seems to work fine:

pi@FIP-Box:/etc $ sudo service dhcpcd status
● dhcpcd.service - dhcpcd on all interfaces
   Loaded: loaded (/lib/systemd/system/dhcpcd.service; enabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/dhcpcd.service.d
           └─wait.conf
   Active: active (running) since Wed 2022-01-12 20:02:05 CET; 58min ago
 Main PID: 495 (dhcpcd)
    Tasks: 2 (limit: 2059)
   CGroup: /system.slice/dhcpcd.service
           ├─436 wpa_supplicant -B -c/etc/wpa_supplicant/wpa_supplicant.conf -iwlan0 -Dnl80211,wext
           └─495 /sbin/dhcpcd -q -w

Jan 12 20:02:01 XXX-Box dhcpcd[370]: eth0: renew in 1800, rebind in 2880, expire in 7200 seconds
Jan 12 20:02:05 XXX-Box dhcpcd[370]: eth0: leased 192.168.X.13 for 864000 seconds
Jan 12 20:02:05 XXX-Box dhcpcd[370]: eth0: adding route to 192.168.X.0/24
Jan 12 20:02:05 XXX-Box dhcpcd[370]: eth0: adding default route via 192.168.X.1
Jan 12 20:02:05 XXX-Box dhcpcd[370]: Too few arguments.
Jan 12 20:02:05 XXX-Box dhcpcd[370]: Too few arguments.
Jan 12 20:02:05 XXX-Box dhcpcd[370]: forked to background, child pid 495
Jan 12 20:02:05 XXX-Box systemd[1]: Started dhcpcd on all interfaces.
Jan 12 20:02:45 XXX-Box dhcpcd[495]: eth0: fe80::XXXX:XXXX:XXXX is reachable again
Jan 12 20:02:45 XXX-Box dhcpcd[495]: eth0: fe80::XXXX:XXXX:XXXX is reachable again

Now I do not know what to do anymore. I suspect it is a dumb newbie error, but I have no clue.

Any help would be really appreciated.

Answer 1

You are mistaken in the function of slaac hwaddr. This only affects the allocation of Stateless Address Autoconfiguration link addresses (and should be the default IMO).

The other addresses are allocated by DHCP; indeed you have 2 IPV4 & 2 IPV6 addresses. How or why has nothing to do with the Pi. You may have 2 DHCP servers.

Incidentally obscuring detail of private addresses is pointless and hiding DHCP assigned addresses just makes it harder for anyone to understand your network.

Answer 2

thank you for your answer. It pointed me in the right direction.

I checked the settings of the DHCPv6 server in my router (a Fritz!Box 6660 Cable): It was set to assign both, the prefix (IA_PD) and the last part of the IPv6 address (IA_NA). I changed it to assign the prefix (IA_PD) only. After a restart of the Raspi he had one IPv6 address only - and this was the hardware address following my setting slaac hwaddr.