3.3.1 Ensure IPv6 router advertisements are not accepted (Not Scored)
Profile Applicability
Level 1 - Server Level 1 - Workstation
Description
This setting disables the system's ability to accept IPv6 router advertisements.
Rationale
It is recommended that systems not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes.
Audit
Run the following command and verify output matches:
# sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.all.accept_ra = 0 # sysctl net.ipv6.conf.default.accept_ra net.ipv6.conf.default.accept_ra = 0
Remediation
Set the following parameter in the /etc/sysctl.conf file:
net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.default.accept_ra = 0
Run the following commands to set the active kernel parameters:
# sysctl -w net.ipv6.conf.all.accept_ra=0 # sysctl -w net.ipv6.conf.default.accept_ra=0 # sysctl -w net.ipv6.route.flush=1