Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default
Sets the default template net.ipv6.conf.default.accept_ra_defrtr to 0 so newly created IPv6 interfaces ignore the default-router information carried in Router Advertisements.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The default-router flag in a Router Advertisement tells a host to install the advertising router as its IPv6 default gateway. Because RAs are unauthenticated, a rogue node can advertise itself as the default router and redirect all of the host's off-link traffic through it (man-in-the-middle). Setting the default template ensures every interface created afterwards inherits the hardened behaviour, not just the ones present at boot.
What Pavois checks
Pavois reads the effective runtime value via the kernel_parameter resource (equivalent to sysctl net.ipv6.conf.default.accept_ra_defrtr) and asserts it is 0. The default key is the template applied to future interfaces, so reading the live kernel value matters: a value declared in /etc/sysctl.d/* may be overridden by a later drop-in or never applied, and only the running parameter proves the template is actually in force.
describe kernel_parameter('net.ipv6.conf.default.accept_ra_defrtr') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.accept_ra_defrtr[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.accept_ra_defrtr (or cat /proc/sys/net/ipv6/conf/default/accept_ra_defrtr). Expected output:
net.ipv6.conf.default.accept_ra_defrtr = 0
Inspect & investigate
No dedicated log. Check the live value with sysctl net.ipv6.conf.default.accept_ra_defrtr, audit its source with sysctl --system, and inspect the resulting default gateway with ip -6 route show default.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.accept_ra_defrtr to 0, persisting it in a Pavois-owned /etc/sysctl.d/ drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.accept_ra_defrtr |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On hosts that rely on SLAAC/RA to learn their default gateway, refusing the default-router flag leaves the new interfaces without an IPv6 default route, breaking off-link IPv6 connectivity. Note this default key only governs interfaces created after it is set; existing interfaces keep their per-interface value. Apply only where IPv6 routing is static or via DHCPv6, verify before enforcing. No effect on IPv4-only systems.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.