Configure ARP filtering for All IPv4 Interfaces
Enforces net.ipv4.conf.all.arp_filter=0, the benchmarked ARP-handling mode for predictable multi-homed behavior.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
net.ipv4.conf.all.arp_filter controls how the kernel answers ARP requests on a multi-homed host. By default (0) the kernel treats the ARP table globally and may answer an ARP request received on one interface with the MAC of another interface. The expected, benchmarked value here is 0: changing this setting affects how the host advertises its addresses and must match the documented network design. Pavois enforces the value the standard prescribes so the host's ARP behavior is predictable and consistent with the rest of the hardening baseline.
What Pavois checks
Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.all.arp_filter') and asserts it equals 0. ARP behavior is determined by the running kernel value, not by what a file says: a sysctl.d entry written but not reloaded, or overridden by a per-interface key, would leave the host behaving differently than the config implies. Reading the effective value is the only way to confirm the actual ARP mode in force.
describe kernel_parameter('net.ipv4.conf.all.arp_filter') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.arp_filter[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.arp_filter. Expected output:
net.ipv4.conf.all.arp_filter = 0
Inspect & investigate
sysctl net.ipv4.conf.all.arp_filtershows the current value.cat /proc/sys/net/ipv4/conf/all/arp_filteris the raw kernel value.- Inspect live ARP behavior with
ip neigh show(the resolved neighbor table) andsysctl -a | grep arp_filterto see bothalland per-interface values, which combine.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.arp_filter to 0. It writes the key into a Pavois-managed drop-in and reloads it so the value is active immediately and persistent across reboots. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.arp_filter |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting arp_filter=0 matches the kernel default, so on single-homed hosts there is no impact. On multi-homed hosts with several interfaces on the same subnet, ARP handling can cause ARP flux (replies from the 'wrong' interface); if your design depends on per-interface ARP filtering, this rule's global 0 may conflict with that. Before applying, review multi-homed hosts and pair this with arp_ignore/arp_announce tuning as your topology requires. No remote-access lockout risk on ordinary single-interface servers.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.