Linux distributions
TMA-ALINUX2-3.2.3
Ensure secure ICMP redirects are not accepted
Description
Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure.
How it is checked
Audit method: Shell command
chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv4.conf.all.secure_redirects 0 && chk net.ipv4.conf.default.secure_redirects 0; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set the following parameters in /etc/sysctl.conf or a /etc/sysctl.d/* file: net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 Run the following commands to set the active kernel parameters: # sysctl -w net.ipv4.conf.all.secure_redirects=0 # sysctl -w net.ipv4.conf.default.secure_redirects=0 # sysctl -w net.ipv4.route.flush=1
Properties
- Operating systems
- alinux-2
- Tags
- cis-convertedkernellinuxsysctl
- Reference
- CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 3.2.3
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target linux