Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces
Stops the host from installing a default IPv6 router learned via Router Advertisements by setting net.ipv6.conf.all.accept_ra_defrtr to 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When accept_ra_defrtr is enabled, the host learns its default IPv6 router from Router Advertisement (RA) messages. An attacker on the link can send illicit RAs to install themselves as the default router, redirecting all the host's IPv6 traffic through them, a classic man-in-the-middle. Hosts with statically configured routing should not accept a default route from RAs.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv6.conf.all.accept_ra_defrtr'), reflecting the running kernel after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. Reading /etc/sysctl.conf alone can disagree with the effective kernel state, especially since IPv6 RA defaults are frequently overridden by drop-ins.
describe kernel_parameter('net.ipv6.conf.all.accept_ra_defrtr') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.accept_ra_defrtr[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.accept_ra_defrtr and expect net.ipv6.conf.all.accept_ra_defrtr = 0.
Inspect & investigate
Confirm with sysctl net.ipv6.conf.all.accept_ra_defrtr (and per-interface sysctl -a | grep accept_ra_defrtr). Inspect the IPv6 routing table for an RA-learned default route with ip -6 route show default, and watch RAs on the wire with tcpdump -ni any 'icmp6 && ip6[40] == 134'.
Remediation
Pavois's harden plan sets net.ipv6.conf.all.accept_ra_defrtr = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.accept_ra_defrtr |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Can break IPv6 connectivity if the network relies on SLAAC. Many IPv6 networks distribute the default gateway exclusively through Router Advertisements; disabling accept_ra_defrtr there leaves the host with no IPv6 default route and effectively no IPv6 reachability. Precaution: only apply on hosts with statically configured IPv6 routing (or those using DHCPv6 for the gateway), or where IPv6 is unused. Verify with ip -6 route show default before and after, and have console/IPv4 access in case remote IPv6 access is lost.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.