Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
Forces the kernel default for new IPv6 interfaces to reject Router Advertisements by setting net.ipv6.conf.default.accept_ra to 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When net.ipv6.conf.default.accept_ra is enabled, the host blindly trusts IPv6 Router Advertisements to learn its default gateway, prefixes and routes. A malicious host on the same link can forge RA messages, advertise itself as the default router and silently become a man-in-the-middle for all IPv6 traffic, enabling interception, redirection or denial of service. Unless the system is an autoconfigured IPv6 client that genuinely needs SLAAC, accepting RAs by default needlessly widens the attack surface.
What Pavois checks
Pavois reads the effective runtime value of net.ipv6.conf.default.accept_ra via the kernel, not a *.conf file. This matters because the live value is the merge of /etc/sysctl.conf, every drop-in under /etc/sysctl.d/, /run/sysctl.d/, kernel boot parameters and anything a tool (NetworkManager, systemd-networkd, a runtime sysctl -w) applied after boot. A file-based scanner can pass on a clean config file while the running kernel still accepts RAs, Pavois catches that drift.
describe kernel_parameter('net.ipv6.conf.default.accept_ra') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.accept_ra[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.accept_ra and confirm the output is net.ipv6.conf.default.accept_ra = 0. The default value applies to interfaces created after it is set; check existing interfaces with sysctl -a | grep '\.accept_ra =' if needed.
Inspect & investigate
There is no dedicated log; inspect runtime state with sysctl net.ipv6.conf.default.accept_ra and sysctl -a | grep accept_ra. To see which file last set the value, run sysctl --system 2>&1 | grep accept_ra or grep /etc/sysctl.d/ and /run/sysctl.d/. Unexpected RA traffic can be observed with ip -6 route show and packet capture (tcpdump -i <if> 'icmp6 && ip6[40] == 134').
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.accept_ra = 0, writing it to a managed drop-in so it survives reboot and applying it live. Run pavois harden apply to enforce it; the value is also re-applied at boot via the persisted sysctl entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.accept_ra |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host that is a normal IPv6 SLAAC client (relies on Router Advertisements for its address, gateway and routes), setting this to 0 will stop it from autoconfiguring IPv6: it can lose its default route and IPv6 connectivity. Before applying, confirm the host uses static IPv6 or DHCPv6 addressing, or is IPv4-only. On routers and statically-addressed servers the change is safe. Apply per-interface exceptions if a specific NIC legitimately needs RAs.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.11, 3.3.2.8 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.