Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
Sets net.ipv6.conf.all.accept_source_route to 0 so the host refuses source-routed IPv6 packets on all interfaces.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Source-routed packets let the sender dictate the path a packet takes, overriding the routing the network would normally choose. An attacker can use this to bypass firewalls and routing-based security controls, reach otherwise unreachable hosts, or spoof return paths. Accepting source-routed traffic has almost no legitimate use on modern hosts and should be disabled unless explicitly required.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.accept_source_route) and asserts it is 0. The live value is authoritative: a value in /etc/sysctl.d/* may be overridden by a later drop-in or never applied, so a file-based scanner can falsely report compliance while the kernel still accepts source routing.
describe kernel_parameter('net.ipv6.conf.all.accept_source_route') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.accept_source_route[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.accept_source_route (or cat /proc/sys/net/ipv6/conf/all/accept_source_route). Expected output:
net.ipv6.conf.all.accept_source_route = 0
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.all.accept_source_route and audit its source with sysctl --system.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.accept_source_route to 0, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.accept_source_route |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
No practical impact on normal hosts: source routing is effectively obsolete and disabled by default on most distributions. The only systems that might rely on it are specialised network appliances doing deliberate path selection, do not enforce there. No risk of lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
| CIS | 3.3.8, 3.3.2.5 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.