Ensure icmpaddressmask is disabled

MediumLevel 1Automatedaix

Description

The icmpaddressmask parameter determines whether the system responds to an ICMP address mask ping. The icmpaddressmask parameter will be set to 0, This means that the system will not respond to ICMP address mask request pings. By default, when this is enabled the system is susceptible to source routing attacks. Audit: `no -o icmpaddressmask` must report 0.

How it is checked

Audit method: Shell command

shell

command -v no >/dev/null 2>&1 || exit 1; out=$(no -o icmpaddressmask 2>/dev/null) || exit 1; printf '%s\n' "$out" | sed 's/[[:blank:]]*=[[:blank:]]*/=/'

Expected output: icmpaddressmask=0

How it is fixed

Fix method: Guidance or infrastructure patch

no -p -o icmpaddressmask=0 (sets the running value and makes it persistent in /etc/tunables/nextboot)

Properties

Operating systems: Any
Tags: aixhardening
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 4.5.5 Ensure icmpaddressmask is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix