Ensure TCP SYN Cookies is enabled

MediaNivel 1Automatizadabottlerocket

Descripción

When tcp_syncookies is set, the kernel will handle TCP SYN packets normally until the half-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. The audit reads the running value from /proc/sys. Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cómo se verifica

Método de auditoría: Comando de shell

shell

bad=0
chk() { f=/proc/sys/$(printf %s "$1" | tr . /); v=$(cat "$f" 2>/dev/null) || { echo "$1: not readable"; bad=1; return; }; [ "$v" = "$2" ] || { echo "$1 = $v (expected $2)"; bad=1; }; }
chk net.ipv4.tcp_syncookies 1
[ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to set the active kernel parameter and persist the setting: # apiclient apply <<EOF [settings.kernel.sysctl] "net.ipv4.tcp_syncookies" = "1" EOF Run the following command to flush the routing cache: # sysctl -w net.ipv4.route.flush=1

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketnetwork
Referencia: CIS Bottlerocket Benchmark v1.0.0 - 3.2.7 Ensure TCP SYN Cookies is enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bottlerocket