Set Kernel Parameter to Increase Local Port Range
Sets the ephemeral source-port range to 32768 65535 via net.ipv4.ip_local_port_range, keeping outbound ports away from privileged and service ports.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This setting defines the ephemeral port range used by TCP and UDP to choose the local (source) port for outbound connections; the first number is the lowest and the second the highest port. A range starting at 32768 keeps ephemeral ports well clear of the privileged (<1024) and registered service ports, avoiding collisions with listening services and providing a larger, less predictable pool of source ports.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv4.ip_local_port_range'), which returns the running range after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. A file scan of /etc/sysctl.conf could report a range that a later drop-in or sysctl -w has changed.
describe kernel_parameter('net.ipv4.ip_local_port_range') do
its('value') { should match(/32768\s+65535/) }
endHow to verify it is applied
Run sysctl net.ipv4.ip_local_port_range and expect net.ipv4.ip_local_port_range = 32768 65535 (the two values are separated by a tab in the actual output).
Inspect & investigate
Confirm the range with sysctl net.ipv4.ip_local_port_range. To see ephemeral ports actually in use, list active sockets with ss -tan and observe the local source ports of outbound connections.
Remediation
Pavois's harden plan sets net.ipv4.ip_local_port_range = 32768 65535 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.ip_local_port_range |
|---|---|
| resource | sysctl |
| value | 32768 65535 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk. Precaution: a host that opens a very large number of concurrent outbound connections (busy proxy, load balancer) benefits from a wide range; this 32768:65535 window gives ~32k ephemeral ports, which is usually plenty but narrower than some tuned setups (e.g. 1024:65535). Also ensure no service is configured to listen on a fixed port inside this range, or it could clash with an ephemeral allocation. Changing the range does not drop existing connections.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.