TMA-BOTTLEROCKET-3.3.1
Ensure SCTP is disabled
Description
The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP. The audit requires the sctp module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.sctp.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).
How it is checked
Audit method: Shell command
grep -qw '^sctp' /proc/modules 2>/dev/null && { echo 'sctp is loaded'; exit 1; }
o=$(modprobe -n -v sctp 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.sctp.allowed 2>/dev/null) || { echo 'sctp can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'sctp is allowed'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to disable the sctp module: # apiclient set kernel.modules.sctp.allowed=false
Properties
- Operating systems
- Any
- Tags
- bottlerocketnetwork
- Reference
- CIS Bottlerocket Benchmark v1.0.0 - 3.3.1 Ensure SCTP is disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target bottlerocket --level 2