Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
Sets the default for new IPv6 interfaces to reject ICMPv6 redirect messages via net.ipv6.conf.default.accept_redirects = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ICMPv6 redirect messages instruct a host to send traffic for a destination via a different next hop. When net.ipv6.conf.default.accept_redirects is enabled, an attacker on the local link can forge redirect messages to alter the host's routing table, diverting traffic through an attacker-controlled gateway, a man-in-the-middle attack, or blackholing it for denial of service. A normal end host should never need to accept ICMPv6 redirects, so disabling them by default closes this vector.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.accept_redirects, not a *.conf file. The live value is the merge of /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel command-line parameters and any runtime sysctl -w. A file-based scanner can pass while the running kernel still accepts redirects; Pavois reports the value actually enforced by the kernel.
describe kernel_parameter('net.ipv6.conf.default.accept_redirects') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.accept_redirects[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.accept_redirects and confirm the output is net.ipv6.conf.default.accept_redirects = 0. Check live interfaces too with sysctl -a | grep '\.accept_redirects ='.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.accept_redirects and sysctl -a | grep accept_redirects. To find which file set it, run sysctl --system 2>&1 | grep accept_redirects. Incoming ICMPv6 redirects can be observed with tcpdump -i <if> 'icmp6 && ip6[40] == 137'; route changes show in ip -6 route show cache.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.accept_redirects = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.accept_redirects |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible impact for end hosts and servers, accepting ICMPv6 redirects is rarely useful and is a known attack surface. The only environments that may rely on redirects are some specialized layer-3 topologies with a single shared gateway; even there, static routes are the safer alternative. The change does not drop existing connections and is reversible by resetting the key, so there is essentially no lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
| CIS | 3.3.5, 3.3.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.