Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
Forces net.ipv4.conf.all.secure_redirects to 0 so the host rejects even "secure" ICMP redirects (those from listed default gateways) on every IPv4 interface.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
secure_redirects lets the host accept ICMP redirect messages, but only from gateways listed in its default-gateway list. Even this restricted form rewrites the routing table on the basis of unauthenticated ICMP packets. A spoofed redirect from (or appearing to come from) a known gateway can divert traffic through an attacker-controlled hop, enabling a man-in-the-middle. Legitimate uses are rare, so it should be disabled (0) unless absolutely required.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.all.secure_redirects from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. A drop-in could declare 0 while a later file or a runtime sysctl -w re-enabled it. Auditing the effective parameter shows what the kernel actually applies to incoming ICMP redirects; reading a file misses such overrides.
describe kernel_parameter('net.ipv4.conf.all.secure_redirects') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.secure_redirects[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.secure_redirects. Expected output:
net.ipv4.conf.all.secure_redirects = 0
Inspect & investigate
No dedicated log exists for this tunable. With log_martians enabled, anomalous redirect-related packets surface via dmesg | grep -i martian and journalctl -k. Inspect the state with sysctl net.ipv4.conf.all.secure_redirects and all redirect settings with sysctl -a | grep redirects.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.secure_redirects to 0, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.secure_redirects |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling secure redirects is safe on end hosts and ordinary servers; modern networks rely on routing protocols, not ICMP redirects, to converge. The rare exception is a host that deliberately depends on its gateway sending redirects to optimise paths. Note that shared_media, if enabled, can implicitly re-enable secure redirects, keep both aligned (see net.ipv4.conf.all.shared_media). There is no risk to remote access from setting this to 0.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 1.4.3, 3.3.6, 3.3.1.10 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.3 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.