Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
Sets the default for new IPv6 interfaces to drop source-routed packets via net.ipv6.conf.default.accept_source_route = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Source-routed packets let the sender dictate the path their packet takes through the network instead of letting routers decide. An attacker can use this to bypass network security controls (firewalls, segmentation) and reach hosts that should be unreachable, or to spoof trusted source addresses. IPv6 source routing has almost no legitimate use on a modern host. Disabling acceptance of source-routed packets by default removes this evasion and spoofing vector unless the system is explicitly required to forward such traffic.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.accept_source_route, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w. A green file does not prove a green kernel; Pavois reports what the kernel actually enforces.
describe kernel_parameter('net.ipv6.conf.default.accept_source_route') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.accept_source_route[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.accept_source_route and confirm the output is net.ipv6.conf.default.accept_source_route = 0.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.accept_source_route and sysctl -a | grep accept_source_route. To find which file set it, run sysctl --system 2>&1 | grep accept_source_route. Source-routed IPv6 packets carry a Routing extension header (next-header 43) and can be captured with tcpdump -i <if> 'ip6 && ip6[6] == 43'.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.accept_source_route = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.accept_source_route |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Effectively no impact on normal hosts and servers, source routing is virtually never used legitimately and is disabled by default on most modern kernels. The only systems that could be affected are specialized routers explicitly relying on source routing, which is strongly discouraged. The change does not disrupt existing sessions and is fully reversible, so there is no lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
| CIS | 1.4.2, 3.3.8, 3.3.2.6 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6, CM-6(a), CM-6(b), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.