← All rules
SOCLE-CLD-SYS-022// Kernel & network (sysctl)mediumeffective runtime

Disable Accepting Packets Routed Between Local Interfaces

Sets net.ipv4.conf.all.accept_local=0 so the kernel rejects inbound packets that spoof one of the host's own local source addresses.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

When net.ipv4.conf.all.accept_local=1, the kernel accepts packets arriving on an interface whose source address is one of the host's own local addresses (including the 127.0.0.0/8 loopback block). An attacker on the wire can craft such spoofed packets to impersonate the host to itself and bypass filters that trust local source addresses. Setting it to 0 makes the kernel treat these as invalid (martian) packets and drop them, closing a local-address spoofing vector. This is rarely needed outside of specific routing setups.

What Pavois checks

Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.all.accept_local') and asserts it equals 0. The all key sets the effective default the kernel applies; reading the running value catches a drop-in that was written but never reloaded, or one overridden by a later file. A file-only scan of sysctl.d cannot prove what the kernel is actually enforcing on incoming packets.

describe kernel_parameter('net.ipv4.conf.all.accept_local') do
  its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.accept_local[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv4.conf.all.accept_local. Expected output:

net.ipv4.conf.all.accept_local = 0

Inspect & investigate

  • sysctl net.ipv4.conf.all.accept_local shows the current value.
  • cat /proc/sys/net/ipv4/conf/all/accept_local is the raw kernel value.
  • Packets dropped as martian are only logged if log_martians is enabled, see the related sysctl-net-ipv4-conf-all-log_martians rule, after which dropped spoofed packets appear in dmesg / journalctl -k as martian source entries.

Remediation

Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.accept_local to 0. It writes the key into a Pavois-managed drop-in and reloads it so the setting is active immediately and persistent across reboots. Apply it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keynet.ipv4.conf.all.accept_local
resourcesysctl
value0
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

For a standard host this is the safe default and has no effect on normal traffic. The exception is a niche topology where you deliberately route packets between two of the host's own interfaces over the wire (some load-balancing or multi-homed router designs rely on accept_local=1). Before applying, confirm the host is not such a router; if it is, this rule will break that path and you should scope the relaxation to the specific interface rather than disabling the protection globally.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R12direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references