Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces
Sets net.ipv6.conf.all.accept_ra_rtr_pref to 0 so the host ignores the Router Preference field carried in IPv6 Router Advertisements on all interfaces.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The Router Preference (low/medium/high) in a Router Advertisement lets routers influence which default gateway a host prefers. Since RAs are unauthenticated, a rogue node can advertise itself with high preference to win gateway selection and divert the host's traffic through it (man-in-the-middle). Honouring router preference is unnecessary on hosts with statically configured routing.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.accept_ra_rtr_pref) and asserts it is 0. Reading the live kernel value beats parsing /etc/sysctl.d/*, where a setting may be overridden by a later drop-in or simply never applied, a file-based scanner would report a false pass.
describe kernel_parameter('net.ipv6.conf.all.accept_ra_rtr_pref') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.accept_ra_rtr_pref[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.accept_ra_rtr_pref (or cat /proc/sys/net/ipv6/conf/all/accept_ra_rtr_pref). Expected output:
net.ipv6.conf.all.accept_ra_rtr_pref = 0
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.all.accept_ra_rtr_pref, audit its source with sysctl --system, and inspect the resulting default routes with ip -6 route show default.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.accept_ra_rtr_pref to 0, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.accept_ra_rtr_pref |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This only affects how a host picks among multiple RA-advertising routers; it does not by itself remove IPv6 connectivity. On hosts using SLAAC with several upstream routers, ignoring router preference may lead to a less optimal default gateway choice. On static-IPv6 servers there is no impact. Do not enforce on routers that must honour preference signalling.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.