Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces
Sets net.ipv6.conf.all.max_addresses to 1, capping the number of autoconfigured IPv6 addresses an interface may hold to match a static, single-address policy.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Each interface should hold only the IPv6 addresses it actually needs, ideally exactly the statically configured ones. An unbounded count lets autoconfiguration or a flood of forged Router Advertisements pile up many global addresses on an interface, which consumes resources and complicates monitoring by making it harder to know which addresses are legitimate. Capping the count keeps the address set predictable.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.max_addresses) and asserts it is 1. The live kernel value is authoritative: a value declared in /etc/sysctl.d/* may be overridden by a later drop-in or never applied, so reading the running parameter avoids the false pass a file-based scanner can give.
describe kernel_parameter('net.ipv6.conf.all.max_addresses') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.max_addresses[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.max_addresses (or cat /proc/sys/net/ipv6/conf/all/max_addresses). Expected output:
net.ipv6.conf.all.max_addresses = 1
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.all.max_addresses, audit its source with sysctl --system, and count the addresses actually present with ip -6 addr show.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.max_addresses to 1, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.max_addresses |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A cap of 1 is intended for hosts with a single static IPv6 address per interface. It will break setups that legitimately need several addresses per interface, SLAAC with privacy/temporary addresses (which use multiple addresses), virtual hosting, or interfaces bound to many service IPs. Before applying, confirm a single-address policy or raise the value to the real number of required addresses. Exceeding the cap silently prevents new addresses from being assigned.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.