Description
IPv6 routers announce prefixes and default routes with router advertisements (RA). With
accept_ra on, the kernel uses them to add addresses and a default route on its own. This
control sets net.ipv6.conf.all.accept_ra and net.ipv6.conf.default.accept_ra (interfaces
created later) to 0, so that IPv6 addresses and routes are only those configured on purpose.
systemd-networkd processes RAs itself and keeps the kernel accept_ra of the links it manages
at 0, so this setting does not prevent networkd from using RAs when its configuration asks
for it. Disabling IPv6 altogether is decided in CB-DEB-NET-001.
Rationale
Router advertisements are not authenticated. A rogue RA, sent by an attacker or by a misconfigured machine, makes the host route its IPv6 traffic, often preferred over IPv4, through the sender (man in the middle) or lose connectivity.
Impact
Hosts that get their IPv6 address and route from SLAAC lose them for interfaces brought up after
the change. Configure IPv6 statically, or let the network manager handle RAs on the trusted
interfaces only (systemd-networkd IPv6AcceptRA=, NetworkManager ipv6.method).
Applies when
Detected: when: IPv6 is enabled in the kernel A scanner reports the control not applicable when one is false.
Setting
| Location | sysctl `net.ipv6.conf.{all,default}.accept_ra`, persisted in `/etc/sysctl.d/` |
| Default | 1 |
| Recommended | 0 |
Audit
Run sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.default.accept_ra. Both must be 0.
Check that no sysctl file sets another value.
Automated: every check must pass. Scanners report each check by its id.
all-accept-ra
net.ipv6.conf.all.accept_ra.
key: net.ipv6.conf.all.accept_ra
value: 0
default-accept-ra
net.ipv6.conf.default.accept_ra.
key: net.ipv6.conf.default.accept_ra
value: 0
Remediation
Add to /etc/sysctl.d/60-cirsec.conf:
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
remove other assignments, then run sysctl --system.
| Restart | none |
| Disruption | low |
Rollback
Remove the lines from /etc/sysctl.d/60-cirsec.conf and run sysctl -w net.ipv6.conf.all.accept_ra=1 net.ipv6.conf.default.accept_ra=1.
all-accept-ra
Generated from check all-accept-ra: the engine writes the fix for every output, it sets the expected value and the check runs again after.
default-accept-ra
Generated from check default-accept-ra: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Linux kernel documentation - IP Sysctl The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
- RFC 4861 - Neighbor Discovery for IP version 6 (IPv6) IETF, rfc, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R13 | related | R13 asks to disable IPv6 when unused, and to secure it otherwise. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
Related controls
- related
CB-DEB-NET-001Decide whether IPv6 is used, and disable or secure it accordingly
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM 921, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated check, fix and check again; values kept after reboot; networkd DHCP connectivity unaffected. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM 931, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated check, fix and check again; values kept after reboot; networkd DHCP connectivity unaffected. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
