← All rules
SOCLE-CLD-SYS-026// Kernel & network (sysctl)mediumeffective runtime

Configure Response Mode of ARP Requests for All IPv4 Interfaces

Sets net.ipv4.conf.all.arp_ignore=2 so the host answers ARP only for the receiving interface's own IP from a same-subnet sender.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

net.ipv4.conf.all.arp_ignore decides which ARP requests the host answers. In the default mode (0) the host replies to an ARP request for any of its local addresses regardless of which interface the request arrived on, which on a multi-homed host causes ARP flux: a neighbor can learn the host's IP behind the wrong MAC/interface, and an attacker can exploit the ambiguity to map and target the host. Setting it to 2 makes the host reply only when the target IP is local to the receiving interface and the sender is on the same subnet, producing deterministic, harder-to-abuse ARP behavior.

What Pavois checks

Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.all.arp_ignore') and asserts it equals 2. ARP reply behavior is governed by the running kernel value, so a sysctl.d entry written but not reloaded, or overridden by a per-interface key, would leave the host answering ARP differently than the file suggests. Only the effective value confirms the actual ARP response mode in force.

describe kernel_parameter('net.ipv4.conf.all.arp_ignore') do
  its('value') { should cmp 2 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.arp_ignore[[:space:]]*=[[:space:]]*2([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv4.conf.all.arp_ignore. Expected output:

net.ipv4.conf.all.arp_ignore = 2

Inspect & investigate

  • sysctl net.ipv4.conf.all.arp_ignore shows the current value.
  • cat /proc/sys/net/ipv4/conf/all/arp_ignore is the raw kernel value.
  • Observe the live neighbor/ARP table with ip neigh show, and use sysctl -a | grep arp_ignore to see both all and per-interface values, which combine.

Remediation

Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.arp_ignore to 2. It writes the key into a Pavois-managed drop-in and reloads it so the stricter ARP reply mode is active immediately and persistent across reboots. Apply it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keynet.ipv4.conf.all.arp_ignore
resourcesysctl
value2
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

On a single-homed host this rarely changes anything visible. The important caveat is multi-homed hosts, load balancers and clustering: technologies like LVS/IPVS Direct Routing, keepalived/VRRP and some HA setups deliberately rely on cross-interface ARP and may break with arp_ignore=2. Before applying, audit any host that owns shared/virtual IPs or runs an L4 load balancer. There is no SSH-lockout risk on a normal single-interface server, but on clustered nodes validate failover after applying.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R12direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references