Configure Accepting Router Advertisements on All IPv6 Interfaces
Sets the kernel parameter net.ipv6.conf.all.accept_ra to 0 so the host ignores IPv6 Router Advertisement (RA) messages on all interfaces.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IPv6 Router Advertisements are unauthenticated. A rogue node on the local segment can broadcast forged RAs to advertise itself as the default gateway, then intercept, reroute or modify traffic (man-in-the-middle). Accepting RAs also lets an attacker push prefixes and routes that reshape the host's routing table. On a server with statically configured addressing, RA processing brings no benefit and only widens the attack surface.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.accept_ra) and asserts it is 0. Reading the live kernel value beats grepping /etc/sysctl.conf or /etc/sysctl.d/*: a setting can be present in a file yet overridden by a later drop-in, a GRUB boot argument, or a network manager, and a file can declare the value without it ever being applied. The effective read reflects what the kernel is actually doing now.
describe kernel_parameter('net.ipv6.conf.all.accept_ra') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.accept_ra[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.accept_ra (or cat /proc/sys/net/ipv6/conf/all/accept_ra). Expected output:
net.ipv6.conf.all.accept_ra = 0
Inspect & investigate
There is no dedicated log for this parameter. Inspect the live value with sysctl net.ipv6.conf.all.accept_ra, list all related keys with sysctl -a | grep accept_ra, and review where it was set with sysctl --system (which prints each applied file). Unexpected RA-driven routing changes can be observed with ip -6 route show and ip -6 neigh.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.accept_ra to 0, persisting it in a Pavois-owned drop-in under /etc/sysctl.d/ and applying it live so no reboot is needed. Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.accept_ra |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host that relies on IPv6 autoconfiguration (SLAAC) for its address and default route, disabling RA acceptance will remove its IPv6 connectivity, it will no longer learn a gateway automatically. Before applying, confirm the host uses static IPv6 addressing or obtains addresses via DHCPv6 with manually configured routes; this is the normal case for servers. Routers and gateways that must process RAs should not have this rule enforced. No risk for IPv4-only or static-IPv6 systems.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.11, 3.3.2.7 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.