Configure Sending and Accepting Shared Media Redirects by Default
Disables shared-media redirect behavior on new IPv4 interfaces by setting net.ipv4.conf.default.shared_media to 0, so it cannot silently re-enable secure redirects.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This setting must be aligned with net.ipv4.conf.default.secure_redirects because it overrides it: if shared_media is enabled for an interface, secure redirects are implicitly enabled too. Leaving it on therefore re-opens the ICMP-redirect attack surface (routing-table tampering, man-in-the-middle) even when secure_redirects is set to 0.
What Pavois checks
Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.default.shared_media'), reflecting the running setting after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. This matters here because shared_media overrides secure_redirects, so only the effective value reveals the true state, a file scan of /etc/sysctl.conf alone cannot.
describe kernel_parameter('net.ipv4.conf.default.shared_media') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.shared_media[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.shared_media and expect net.ipv4.conf.default.shared_media = 0.
Inspect & investigate
Check the effective value with sysctl net.ipv4.conf.default.shared_media, and cross-check sysctl net.ipv4.conf.default.secure_redirects since shared_media can override it. Per-interface state: sysctl -a | grep shared_media.
Remediation
Pavois's harden plan sets net.ipv4.conf.default.shared_media = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.shared_media |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe on standard hosts. Precaution: shared_media only matters in shared-medium / multi-subnet-on-one-segment topologies where multiple IP subnets share a single physical link; disabling it there may break expected redirect behavior. On ordinary point-to-point or switched LANs there is no functional impact. The default key applies to new interfaces only, align net.ipv4.conf.all.shared_media for existing ones.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.