# Ensure ipv6 router advertisements are not accepted

Necessity: IPv6 Router Advertisements (RAs) are used by routers to announce their presence and provide network configuration parameters to hosts, enabling features like Stateless Address Autoconfiguration (SLAAC). If a host that is not meant to be an IPv6 client (e.g., a server with a static IP address) accepts these advertisements, it becomes vulnerable to network attacks. A malicious actor on the same local network could send spoofed RAs to perform a man-in-the-middle (MITM) attack, redirecting the victim's IPv6 traffic. Disabling the acceptance of RAs mitigates this risk by ensuring the host ignores such unsolicited network configuration announcements.

Auditing and Remediation: The audit script verifies that the kernel parameters 'net.ipv6.conf.all.accept_ra' and 'net.ipv6.conf.default.accept_ra' are both set to '0', which disables this feature for all current and future interfaces. The remediation script applies this setting to the live kernel configuration using 'sysctl' and also writes the configuration to a file under '/etc/sysctl.d/' to ensure it persists across reboots.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '0'. This is a binary security setting with no middle ground. For any system that does not explicitly require SLAAC for its network configuration, accepting RAs introduces an unnecessary security vulnerability without providing any functional benefit. Therefore, the only secure and recommended configuration is to disable it entirely by setting the value to '0'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the values of the sysctl parameters 'net.ipv6.conf.all.accept_ra' and 'net.ipv6.conf.default.accept_ra'. The script must return '0' if both parameters are set to 0, and '1' otherwise. The output must contain only the final value ('0' or '1') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be '0'. The script must set both 'net.ipv6.conf.all.accept_ra' and 'net.ipv6.conf.default.accept_ra' kernel parameters to this value. The change must be applied to the running configuration and made persistent across reboots. The script must return 'true' on successful application of the settings, and 'false' on failure.

