Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
Sets net.ipv4.conf.all.accept_source_route=0 so the kernel drops packets whose sender tries to dictate their network path.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Source-routed packets carry an option that lets the sender dictate the path the packet takes through the network, instead of letting routers decide. An attacker can use this to steer traffic around firewalls and access controls, reach hosts that should be unreachable, or make spoofed packets return to them. Source routing has essentially no legitimate use on modern networks, so net.ipv4.conf.all.accept_source_route=0 should be set to drop such packets and prevent attackers from bypassing network security measures.
What Pavois checks
Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.all.accept_source_route') and asserts it equals 0. The effective value is what governs whether source-routed packets are dropped at this moment; a sysctl.d entry that was never reloaded, or overridden by a later drop-in, leaves the host exposed despite a config file that reads 0. Auditing the running value (not the file) is the only reliable proof.
describe kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.accept_source_route[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.accept_source_route. Expected output:
net.ipv4.conf.all.accept_source_route = 0
Inspect & investigate
sysctl net.ipv4.conf.all.accept_source_routeshows the current value.cat /proc/sys/net/ipv4/conf/all/accept_source_routeis the raw kernel value.- Review both
alland per-interface keys withsysctl -a | grep accept_source_route. Dropped source-routed packets are logged asmartian sourceentries indmesg/journalctl -konly whenlog_martiansis enabled.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.accept_source_route to 0. It writes the key into a Pavois-managed drop-in and reloads it so source-routed packets are dropped immediately and after reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.accept_source_route |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
There is no practical downside for normal systems: source routing is obsolete and disabled by default on most distributions. The only theoretical impact is for legacy network diagnostics or unusual routing labs that intentionally use source-routed packets. There is no risk of remote-access lockout, because ordinary connections never set the source-route option. Apply freely on servers, workstations and routers alike.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 3.3.8, 3.3.1.14 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-5, SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.