Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces
Forces net.ipv4.conf.all.shared_media to 0 so the kernel does not treat subnets as sharing a medium and cannot implicitly re-enable secure ICMP redirects.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
shared_media tells the kernel that different subnets share the same physical medium, which makes it send ICMP redirects between those subnets. Critically, enabling shared_media for an interface also forces secure_redirects on, overriding the hardening of that parameter. To keep ICMP-redirect handling locked down, shared_media must be 0 so it cannot silently re-enable redirect acceptance and expose the host to redirect-based man-in-the-middle attacks.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.all.shared_media from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. Because this parameter can override secure_redirects at runtime, only the effective kernel value reveals the true redirect posture, a config file might say 0 while a later drop-in or sysctl -w flipped it. Reading a file would miss that interaction.
describe kernel_parameter('net.ipv4.conf.all.shared_media') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.shared_media[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.shared_media. Expected output:
net.ipv4.conf.all.shared_media = 0
Then confirm sysctl net.ipv4.conf.all.secure_redirects still reads 0.
Inspect & investigate
No dedicated log exists. Inspect the state with sysctl net.ipv4.conf.all.shared_media and review the related redirect settings together with sysctl -a | grep -E 'shared_media|redirects'. With log_martians on, redirect anomalies show up via journalctl -k.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.shared_media to 0, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.shared_media |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe for standard topologies where each interface serves a single IP subnet. The rare exception is a network that genuinely runs multiple subnets on one shared physical medium and relies on the kernel issuing redirects between them; there, disabling shared_media can prevent hosts from learning optimal cross-subnet routes. For almost all servers this is not the case. Apply alongside the secure_redirects and send_redirects rules so the redirect posture stays consistent. No remote-access risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.