From d1143a06b171bfda8f4dda8a8459a6d067bb925b Mon Sep 17 00:00:00 2001 From: Farid Joubbi Date: Wed, 24 Mar 2021 07:55:29 +0100 Subject: [PATCH] Not accepting source routing for IPv6. This was already done for IPv4. (#424) Signed-off-by: Farid Joubbi --- roles/os_hardening/defaults/main.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml index dac4e09f..63a17422 100644 --- a/roles/os_hardening/defaults/main.yml +++ b/roles/os_hardening/defaults/main.yml @@ -202,6 +202,8 @@ sysctl_config: # so disable it if not needed. | sysctl-13 net.ipv4.conf.all.accept_source_route: 0 net.ipv4.conf.default.accept_source_route: 0 + net.ipv6.conf.all.accept_source_route: 0 + net.ipv6.conf.default.accept_source_route: 0 # For non-routers: don't send redirects. # An attacker could use a compromised host to send invalid ICMP redirects to other