Configure Kernel Parameter for Accepting Secure Redirects By Default
Forces the kernel to reject ICMP secure redirects on newly created IPv4 interfaces by setting net.ipv4.conf.default.secure_redirects to 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. A redirect from a default gateway can still be used to alter a host's routing table and reroute traffic through an attacker-controlled path (man-in-the-middle). Unless the system genuinely relies on dynamic redirects, this should be disabled.
What Pavois checks
Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.default.secure_redirects'), which reflects the running setting after every sysctl.conf, drop-in under /etc/sysctl.d/, kernel command line and runtime override has been merged. A file-based scanner that only greps /etc/sysctl.conf misses values set in drop-ins or applied at runtime, producing false results.
describe kernel_parameter('net.ipv4.conf.default.secure_redirects') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.secure_redirects[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.secure_redirects and expect net.ipv4.conf.default.secure_redirects = 0.
Inspect & investigate
Inspect the effective value with sysctl net.ipv4.conf.default.secure_redirects (and per-interface sysctl -a | grep secure_redirects). To watch redirects on the wire, capture ICMP type 5 with tcpdump -ni any 'icmp[icmptype] == icmp-redirect'.
Remediation
Pavois's harden plan writes net.ipv4.conf.default.secure_redirects = 0 through the sysctl resource: it persists the key in a Pavois-owned drop-in and applies it live so no reboot is needed. Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.secure_redirects |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a normal host this is safe and recommended. Precaution: if the machine legitimately depends on a router sending ICMP redirects to learn better routes (rare, mostly legacy networks), disabling this can cause suboptimal routing. Prefer static routes or a routing daemon instead. The default setting only affects future interfaces; existing interfaces also need net.ipv4.conf.all.secure_redirects = 0 and a re-apply or interface bounce to take full effect.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 3.3.6, 3.3.1.11 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-7(a), CM-7(b), SC-5, SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.