Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default
Sets the default for new IPv6 interfaces to ignore prefix information in Router Advertisements via net.ipv6.conf.default.accept_ra_pinfo = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
net.ipv6.conf.default.accept_ra_pinfo controls whether the host learns network prefixes from Router Advertisements. If enabled, an attacker who can inject forged RAs can advertise rogue prefixes, causing the host to autoconfigure addresses on attacker-controlled networks and to route traffic through a malicious gateway, a classic man-in-the-middle vector. Disabling prefix-information acceptance by default prevents an untrusted on-link host from reshaping the system's IPv6 addressing.
What Pavois checks
Pavois reads the effective runtime value of net.ipv6.conf.default.accept_ra_pinfo from the kernel rather than parsing a config file. The live value is the result of merging /etc/sysctl.conf, all drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel command-line parameters and any runtime sysctl -w. A file scan can be green while the running kernel still accepts RA prefix info; Pavois reports the truth as the kernel sees it.
describe kernel_parameter('net.ipv6.conf.default.accept_ra_pinfo') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.accept_ra_pinfo[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.accept_ra_pinfo and confirm the output is net.ipv6.conf.default.accept_ra_pinfo = 0.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.accept_ra_pinfo and sysctl -a | grep accept_ra_pinfo. To find which file set it, run sysctl --system 2>&1 | grep accept_ra_pinfo. Autoconfigured addresses learned from prefixes can be listed with ip -6 addr show.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.accept_ra_pinfo = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.accept_ra_pinfo |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host relying on SLAAC for IPv6 addressing, refusing prefix information stops it from forming global IPv6 addresses, breaking IPv6 connectivity. Before applying, confirm the host uses static IPv6 or DHCPv6, or is IPv4-only. Routers and statically-addressed servers are unaffected. Combine with the other accept_ra* rules for a coherent posture rather than toggling one in isolation.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.