Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
Tells the kernel to drop bogus ICMP error responses (e.g. to broadcast frames) by setting net.ipv4.icmp_ignore_bogus_error_responses to 1.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Some routers violate RFC 1122 by sending bogus ICMP error responses to broadcast frames. Ignoring these responses prevents an attacker (or a misbehaving device) from flooding the kernel log with crafted ICMP errors and keeps logs focused on real events. The trade-off is that a small amount of genuine activity would not be logged.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv4.icmp_ignore_bogus_error_responses'), reflecting the running kernel once all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. Grepping /etc/sysctl.conf alone can disagree with what the kernel actually enforces.
describe kernel_parameter('net.ipv4.icmp_ignore_bogus_error_responses') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.icmp_ignore_bogus_error_responses[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.icmp_ignore_bogus_error_responses and expect net.ipv4.icmp_ignore_bogus_error_responses = 1.
Inspect & investigate
Confirm the value with sysctl net.ipv4.icmp_ignore_bogus_error_responses. The effect is visible as the absence of bogus-ICMP messages in the kernel ring buffer, check with journalctl -k or dmesg.
Remediation
Pavois's harden plan sets net.ipv4.icmp_ignore_bogus_error_responses = 1 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.icmp_ignore_bogus_error_responses |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Essentially no operational impact: only malformed/bogus ICMP error responses are suppressed, normal ICMP error handling (path-MTU discovery, destination-unreachable, etc.) is untouched. Precaution: if you are actively troubleshooting a flaky router that emits these errors, you will lose the corresponding kernel-log noise, re-enable temporarily only if that diagnostic is needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 1.4.2, 3.3.3, 3.3.1.6 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-7(a), CM-7(b), SC-5 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.