Disable Kernel Parameter for IPv6 Forwarding
Sets net.ipv6.conf.all.forwarding to 0 so the kernel does not forward IPv6 packets between interfaces (the host is not a router).
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IPv6 forwarding lets the kernel route packets from one interface to another, turning the host into a router. This is only appropriate for systems explicitly acting as gateways. On an end host or server, leaving forwarding enabled can allow traffic to transit the machine, bridging network segments that should remain isolated and bypassing perimeter controls.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.forwarding) and asserts it is 0. The live value is authoritative: forwarding is frequently toggled at runtime by containers, VPNs or NetworkManager, so a value declared in /etc/sysctl.d/* may be overridden in the running kernel, only reading the live parameter catches that.
describe kernel_parameter('net.ipv6.conf.all.forwarding') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.forwarding[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.forwarding (or cat /proc/sys/net/ipv6/conf/all/forwarding). Expected output:
net.ipv6.conf.all.forwarding = 0
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.all.forwarding, audit its source with sysctl --system, and watch for runtime overrides from container/VPN tooling.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.forwarding to 0, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.forwarding |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling forwarding breaks any role that routes IPv6 traffic: routers, gateways, NAT boxes, VPN concentrators, and container/Kubernetes hosts that route pod traffic over IPv6. Before applying, confirm the system is a plain end host or server. Enforcing this on a forwarding node will cut off downstream IPv6 connectivity, exclude such hosts from the rule. No risk on non-routing systems.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.1, 3.3.2.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6, CM-6(a), CM-6(b), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.