Ensure nonlocsrcroute is disabled

MediumLevel 1Automatedaix

Description

The nonlocsrcroute parameter determines whether the system allows source routed packets to be addressed to hosts outside of the LAN. The nonlocsrcroute parameter will be set to 0. This means that the system will not allow source routed packets to be addressed to hosts outside of the LAN. By default, when this is enabled the system is susceptible to source routing attacks. Audit: `no -o nonlocsrcroute` must report 0.

How it is checked

Audit method: Shell command

shell

command -v no >/dev/null 2>&1 || exit 1; out=$(no -o nonlocsrcroute 2>/dev/null) || exit 1; printf '%s\n' "$out" | sed 's/[[:blank:]]*=[[:blank:]]*/=/'

Expected output: nonlocsrcroute=0

How it is fixed

Fix method: Guidance or infrastructure patch

no -p -o nonlocsrcroute=0 (sets the running value and makes it persistent in /etc/tunables/nextboot)

Properties

Operating systems: Any
Tags: aixnetwork
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 4.5.15 Ensure nonlocsrcroute is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix