Configure Denying Router Solicitations on All IPv6 Interfaces By Default
Stops new IPv6 interfaces from sending Router Solicitation messages by setting net.ipv6.conf.default.router_solicitations = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
net.ipv6.conf.default.router_solicitations sets how many Router Solicitation messages the host sends to discover routers when an interface comes up. Sending solicitations actively announces the host's presence on the link and invites Router Advertisements, which an attacker can answer with forged RAs to seize a man-in-the-middle position. On hosts that do not rely on SLAAC, setting this to 0 stops the host from soliciting routers, reducing its discoverability and its exposure to rogue RA replies.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.router_solicitations, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w. A green file does not prove a green kernel; Pavois reports the value actually enforced.
describe kernel_parameter('net.ipv6.conf.default.router_solicitations') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.router_solicitations[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.router_solicitations and confirm the output is net.ipv6.conf.default.router_solicitations = 0.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.router_solicitations and sysctl -a | grep router_solicitations. To find which file set it, run sysctl --system 2>&1 | grep router_solicitations. Outgoing solicitations can be captured with tcpdump -i <if> 'icmp6 && ip6[40] == 133'.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.router_solicitations = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.router_solicitations |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host that relies on SLAAC, suppressing router solicitations can delay or prevent it from discovering its default router on link-up, breaking IPv6 connectivity (the host will only learn routes from unsolicited periodic RAs, if any). Before applying, confirm the host uses static IPv6 or DHCPv6, or is IPv4-only. On routers and statically-addressed servers the change is safe and reversible by resetting the key.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R13 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.