Nginx will not start with IPv6 Error - "Address family not supported by protocol"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Nginx fails to start after install
• /var/log/cb/nginx/startup.log contains the following messages

  • Starting cb-nginx: nginx: [emerg] socket() [::]:80 failed (97: Address family not supported by protocol) [FAILED]
    nginx: [emerg] socket() [::]:80 failed (97: Address family not supported by protocol)
    
    ​<err> gunicorn.error - Can't connect to ('::', 5600)

• Startup logs for other services may have the following error

  • Can't connect to ('::', 5600)

 

Environment

• EDR Server: 5.x and Above

Cause

IPv6 is disabled on the server

Resolution

#%$ If running a clustered environment, changes must be made on both primary and minions #%$ 

1. Edit /etc/hosts 
   • Comment out the line ::1         localhost

#::1         localhost

2. Edit /etc/cb/cb.conf
   • Change the line for CoreServicesIP to 

CoreServicesIP="0.0.0.0"

• Add the following lines

LiveResponseIP=127.0.0.1
WebsocketBindHost=127.0.0.1

• For 6.1 and above, add the line

SensorServicesIP=0.0.0.0

3. Edit /etc/cb/nginx/conf.d/cb.conf
   • Comment out listen [::]:80 ipv6only=off;​

#listen [::]:80 ipv6only=off;

• Change listen [::]:443 ssl ipv6only=off; to

listen 0.0.0.0:443 ssl;

4. In 5.2 and above, comment out the line listen [::]:80 ipv6only=off; in /etc/cb/nginx/conf.d/http.conf

#listen [::]:80 ipv6only=off;

5. In 6.4.0 and above with TLS Certificate Management enabled, change the /var/cb/nginx/vhosts/*.conf file (example: server_1.conf)

NOTE:  To avoid this problem in the future, add this line to /etc/cb.conf, and restart CB services:

NginxVhostsAddress=0.0.0.0

• Change listen [::]:443; to

listen 0.0.0.0:443 ssl;

6. Restart Services.

Additional Information

• In EDR 6.4.0 the ability to have multiple server certificates in the product was introduced. As a result new configuration files for nginx can be found in /var/cb/nginx/vhosts/*.conf where lines like "listen [::]:443 ssl; " try to bind to an IPV6 address. If IPV6 has been disabled, this will prevent NGINX service from starting.
• Adding NginxVhostsAddress=0.0.0.0 to cb.conf will force CB server to create an IPV4 formatted vhosts/*.conf format required when IPV6 has been disabled on the machine.