← All rules
SOCLE-CLD-SYS-050// Kernel & network (sysctl)mediumeffective runtime

Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces

Stops the host from installing a default IPv6 router learned via Router Advertisements by setting net.ipv6.conf.all.accept_ra_defrtr to 0.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

When accept_ra_defrtr is enabled, the host learns its default IPv6 router from Router Advertisement (RA) messages. An attacker on the link can send illicit RAs to install themselves as the default router, redirecting all the host's IPv6 traffic through them, a classic man-in-the-middle. Hosts with statically configured routing should not accept a default route from RAs.

What Pavois checks

Pavois reads the live value via kernel_parameter('net.ipv6.conf.all.accept_ra_defrtr'), reflecting the running kernel after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. Reading /etc/sysctl.conf alone can disagree with the effective kernel state, especially since IPv6 RA defaults are frequently overridden by drop-ins.

describe kernel_parameter('net.ipv6.conf.all.accept_ra_defrtr') do
  its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.accept_ra_defrtr[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv6.conf.all.accept_ra_defrtr and expect net.ipv6.conf.all.accept_ra_defrtr = 0.

Inspect & investigate

Confirm with sysctl net.ipv6.conf.all.accept_ra_defrtr (and per-interface sysctl -a | grep accept_ra_defrtr). Inspect the IPv6 routing table for an RA-learned default route with ip -6 route show default, and watch RAs on the wire with tcpdump -ni any 'icmp6 && ip6[40] == 134'.

Remediation

Pavois's harden plan sets net.ipv6.conf.all.accept_ra_defrtr = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keynet.ipv6.conf.all.accept_ra_defrtr
resourcesysctl
value0
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Can break IPv6 connectivity if the network relies on SLAAC. Many IPv6 networks distribute the default gateway exclusively through Router Advertisements; disabling accept_ra_defrtr there leaves the host with no IPv6 default route and effectively no IPv6 reachability. Precaution: only apply on hosts with statically configured IPv6 routing (or those using DHCPv6 for the gateway), or where IPv6 is unused. Verify with ip -6 route show default before and after, and have console/IPv4 access in case remote IPv6 access is lost.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R13direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references