Detections
Analytics

3.3.7 Ensure ipv6 router advertisements are not accepted

Information

ICMPv6 RAs(Router Advertisements) are intended to help facilitate bootstrapping the connectivity of an IPv6 node on a network. They tell the hosts on the LAN how they should go about acquiring their global unicast IPv6 address and become productive members of the network. The RA also provides the end-node information about the local router and its ability to be the default gateway. This process is well documented in Section 4 of the IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)".

Unfortunately, there are some security risks related to ICMPv6 RA messages. On networks that do not yet use IPv6, the dual-stack hosts sit dormant waiting for an eventual RA message to awaken their IPv6 connectivity. An attacker can craft a "rogue RA" message on these networks, get the dual-protocol nodes on the network to configure their IPv6 addresses and utilize the attacker's system as their default gateway. The attacker can then easily perform a Man-In-The-Middle (MITM) attack without the user's knowledge using this technique. This issue is documented in RFC 6104 "Rogue IPv6 Router Advertisement Problem Statement". On networks that already have IPv6 running, rogue RAs can destabilize the network (and still perform a MITM attack).

This setting disables the system's ability to accept IPv6 router advertisements.

It is recommended that systems do not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes. Setting net.inet6.ip6.accept_rtadv to 0 disables the system's ability to accept IPv6 router advertisements. This is the default in FreeBSD system.

Solution

-IF- IPv6 is enabled on the system:

Set the following parameters in /etc/sysctl.conf :

net.inet6.ip6.accept_rtadv=0

Example:

# printf "net.inet6.ip6.accept_rtadv=0\n" >> /etc/sysctl.conf

Run the following command to set the active kernel parameters:

# sysctl net.inet6.ip6.accept_rtadv=0

Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|9.2

Plugin: Unix

Control ID: 9e504021c158253af2310821bce7dffd7ab0fd9825cd16723eb3e00cd2e0d72a