Configure Denying Router Solicitations on All IPv6 Interfaces
Sets net.ipv6.conf.all.router_solicitations to 0 so the host sends no IPv6 Router Solicitation messages on any interface.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Router Solicitations are sent by a host to actively ask local routers to send Router Advertisements. Emitting them announces the host's presence on the segment and triggers RA-based autoconfiguration that a rogue router could answer. A statically configured host has no need to solicit routers; suppressing these messages reduces its visibility and removes an autoconfiguration trigger.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.all.router_solicitations) and asserts it is 0. The live value is authoritative: a value in /etc/sysctl.d/* may be overridden by a later drop-in or never applied, so reading the running parameter avoids the false pass a file-based scanner (OVAL/oscap) can give.
describe kernel_parameter('net.ipv6.conf.all.router_solicitations') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.all.router_solicitations[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.all.router_solicitations (or cat /proc/sys/net/ipv6/conf/all/router_solicitations). Expected output:
net.ipv6.conf.all.router_solicitations = 0
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.all.router_solicitations and audit its source with sysctl --system. RS emission can be observed on the wire with tcpdump -i <iface> icmp6 and ip6[40] == 133.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.all.router_solicitations to 0, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.all.router_solicitations |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On hosts that depend on SLAAC, not sending Router Solicitations can delay or prevent learning a default route (the host then waits passively for unsolicited RAs, or gets no address at all), breaking IPv6 connectivity. Apply only where the host uses static IPv6 or DHCPv6, confirm the addressing model first. No effect on IPv4-only systems.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.