TMA-ROCKY8-3.3.1.12
Ensure net.ipv4.conf.all.rp_filter is configured
Description
net.ipv4.conf.all.rp_filter controls reverse path filtering for IPv4 traffic on all network interfaces. Reverse path filtering is a security mechanism in Linux that helps prevent IP spoofing and other network attacks. When enabled, it checks if the source IP address of an incoming packet is reachable through the same network interface it was received on. If the packet's source address is not reachable through the interface it arrived on, the packet is dropped. Note: If this system is a router, and uses asymmetrical routing, this recommendation is not applicable.
How it is checked
Audit method: Shell command
chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv4.conf.all.rp_filter 1; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
1. Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.all.rp_filter lines that are not net.ipv4.conf.all.rp_filter=1. Example script: #!/usr/bin/env bash { l_option="net.ipv4.conf.all.rp_filter" l_value="1" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" l_ufw_file="$([ -f /etc/default/ufw ] && \ awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)" [ -f "$(readlink -e "$l_ufw_file")" ] && \ a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep…
Properties
- Operating systems
- rocky-8
- Tags
- cis-convertedkernellinuxsysctl
- Reference
- CIS Rocky Linux 8 Benchmark v3.0.0 - 3.3.1.12
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target linux