Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
Prevents the host from emitting ICMP redirect messages by default by setting net.ipv4.conf.default.send_redirects to 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table and can reveal portions of the network topology to an observer. The ability to send ICMP redirects is only appropriate for systems acting as routers; on a regular host it leaks topology and serves no purpose.
What Pavois checks
Pavois reads the live value with kernel_parameter('net.ipv4.conf.default.send_redirects'), reflecting the running kernel after sysctl.conf, /etc/sysctl.d/ drop-ins and runtime overrides are merged. Reading only /etc/sysctl.conf would miss a value set in a drop-in or applied at runtime.
describe kernel_parameter('net.ipv4.conf.default.send_redirects') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.send_redirects[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.send_redirects and expect net.ipv4.conf.default.send_redirects = 0.
Inspect & investigate
Confirm the effective value with sysctl net.ipv4.conf.default.send_redirects (and sysctl net.ipv4.conf.all.send_redirects). To see whether redirects are emitted, capture ICMP type 5 with tcpdump -ni any 'icmp[icmptype] == icmp-redirect'.
Remediation
Pavois's harden plan sets net.ipv4.conf.default.send_redirects = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.send_redirects |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe on any host that is not a router. Precaution: if the machine is a router/gateway that intentionally issues ICMP redirects to optimize client routing, disabling this changes that behavior, verify the box is meant to route before applying. The default key affects only new interfaces; pair it with net.ipv4.conf.all.send_redirects = 0 for already-configured interfaces.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 1.4.5, 3.3.2, 3.3.1.5 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-5, SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.5 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.