Configure Auto Configuration on All IPv6 Interfaces By Default
Disables IPv6 stateless address autoconfiguration (SLAAC) for new interfaces by setting net.ipv6.conf.default.autoconf = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
net.ipv6.conf.default.autoconf controls stateless address autoconfiguration (SLAAC): when enabled, the host automatically derives global IPv6 addresses from prefixes advertised in Router Advertisements. An attacker who can inject forged RAs can drive the host to configure addresses on rogue prefixes and route through a malicious gateway, a man-in-the-middle vector. On hosts that should use static or DHCPv6 addressing, disabling autoconfiguration by default removes this exposure and keeps addressing under administrative control.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.autoconf, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w (NetworkManager and systemd-networkd both touch this). A clean file can coexist with a kernel that still autoconfigures; Pavois reports the enforced value.
describe kernel_parameter('net.ipv6.conf.default.autoconf') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.autoconf[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.autoconf and confirm the output is net.ipv6.conf.default.autoconf = 0. List current IPv6 addresses with ip -6 addr show to confirm no SLAAC-derived addresses appear unexpectedly.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.autoconf and sysctl -a | grep autoconf. To find which file set it, run sysctl --system 2>&1 | grep autoconf. Autoconfigured addresses (flagged dynamic/mngtmpaddr) are visible with ip -6 addr show.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.autoconf = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.autoconf |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Significant on hosts that depend on SLAAC for their IPv6 address: disabling autoconfiguration can leave them without a usable global IPv6 address and break IPv6 connectivity. Before applying, confirm the host uses static IPv6 or DHCPv6, or is IPv4-only. On dual-stack clients that need IPv6 via RAs, do not apply this rule. The change is reversible by resetting the key, but a remote IPv6-only session could drop, so validate over IPv4 or console first.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.