← All rules
SOCLE-CLD-SYS-041// Kernel & network (sysctl)mediumeffective runtime

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

Prevents the host from emitting ICMP redirect messages by default by setting net.ipv4.conf.default.send_redirects to 0.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 4 standards

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table and can reveal portions of the network topology to an observer. The ability to send ICMP redirects is only appropriate for systems acting as routers; on a regular host it leaks topology and serves no purpose.

What Pavois checks

Pavois reads the live value with kernel_parameter('net.ipv4.conf.default.send_redirects'), reflecting the running kernel after sysctl.conf, /etc/sysctl.d/ drop-ins and runtime overrides are merged. Reading only /etc/sysctl.conf would miss a value set in a drop-in or applied at runtime.

describe kernel_parameter('net.ipv4.conf.default.send_redirects') do
  its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.send_redirects[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv4.conf.default.send_redirects and expect net.ipv4.conf.default.send_redirects = 0.

Inspect & investigate

Confirm the effective value with sysctl net.ipv4.conf.default.send_redirects (and sysctl net.ipv4.conf.all.send_redirects). To see whether redirects are emitted, capture ICMP type 5 with tcpdump -ni any 'icmp[icmptype] == icmp-redirect'.

Remediation

Pavois's harden plan sets net.ipv4.conf.default.send_redirects = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keynet.ipv4.conf.default.send_redirects
resourcesysctl
value0
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Safe on any host that is not a router. Precaution: if the machine is a router/gateway that intentionally issues ICMP redirects to optimize client routing, disabling this changes that behavior, verify the box is meant to route before applying. The default key affects only new interfaces; pair it with net.ipv4.conf.all.send_redirects = 0 for already-configured interfaces.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R12direct2.0high
CIS1.4.5, 3.3.2, 3.3.1.5directper OS, see the benchmark tablehigh
NIST3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-5, SC-7(a)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
PCI DSS1.4.5supporting4.0.1medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references