# Ensure ipv6 router advertisements are not accepted

Necessity: IPv6 Router Advertisements (RAs) are used by routers to announce their presence and network parameters. If a system is not a router, it should not accept these advertisements. Accepting RAs on a non-router host can expose it to Man-in-the-Middle (MITM) attacks, where a malicious actor on the local network sends spoofed RAs to redirect traffic through an attacker-controlled device, or cause Denial of Service (DoS) by providing incorrect network configuration. Disabling this feature is a critical hardening step for hosts on an IPv6 network.

Auditing and Remediation: The audit script verifies the runtime configuration of two kernel parameters: 'net.ipv6.conf.all.accept_ra' (for all interfaces) and 'net.ipv6.conf.default.accept_ra' (for any future interfaces). The remediation script sets both of these parameters to '0', which instructs the kernel to ignore incoming IPv6 RAs. It also writes this configuration to a file in '/etc/sysctl.d/' to ensure the setting persists across reboots.

Recommended State Rationale: 
Basic, Moderate, and Strict: All hardening levels recommend the state '0,0'. This is a binary security control; either RAs are accepted, or they are not. For any system that is not explicitly functioning as a router, the only secure configuration is to disable acceptance ('0'). Setting both the 'all' and 'default' parameters ensures comprehensive protection for all current and future network interfaces. There is no less-secure 'moderate' state that provides any meaningful security benefit.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0,0']` |
| **Moderate** | `['0,0']` |
| **Strict** | `['0,0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the values of the kernel parameters 'net.ipv6.conf.all.accept_ra' and 'net.ipv6.conf.default.accept_ra' using the 'sysctl -n' command. The script must output the two values as a single comma-separated string (e.g., '0,0') with no extra text, labels, or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which must be a numeric value (e.g., '0' or '1'). The script must set both the 'net.ipv6.conf.all.accept_ra' and 'net.ipv6.conf.default.accept_ra' kernel parameters to this value using 'sysctl -w' and also create a persistent configuration in '/etc/sysctl.d/'. The script must return 'true' on success and 'false' on failure.

