Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default
Limits the number of autoconfigured IPv6 addresses per new interface to one by setting net.ipv6.conf.default.max_addresses = 1.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
net.ipv6.conf.default.max_addresses caps how many autoconfigured (SLAAC) IPv6 addresses an interface may hold. Without a tight cap, a flood of forged Router Advertisements carrying many prefixes can make the host configure a large number of addresses, exhausting memory and creating a denial-of-service condition, and it complicates auditing the host's true network identity. Limiting the count to the number of statically required addresses bounds this exposure; the value 1 enforces a strict single-address default.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.max_addresses, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w. A clean file does not prove the running kernel enforces the cap; Pavois reports the value actually in effect.
describe kernel_parameter('net.ipv6.conf.default.max_addresses') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.max_addresses[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.max_addresses and confirm the output is net.ipv6.conf.default.max_addresses = 1. Count current addresses per interface with ip -6 addr show.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.max_addresses and sysctl -a | grep max_addresses. To find which file set it, run sysctl --system 2>&1 | grep max_addresses. The number of addresses currently held is visible with ip -6 addr show dev <if>.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.max_addresses = 1, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.max_addresses |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A cap of 1 is appropriate for hosts with a single static or SLAAC address per interface, but it will break legitimate multi-address setups: SLAAC with privacy extensions (temporary addresses) needs at least 2-3, and hosts with multiple prefixes or aliases need more. Before applying, confirm the host does not use IPv6 privacy addresses or multiple IPv6 addresses per interface; if it does, raise the value to match the real requirement rather than leaving it at 1.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.