Ensure SCTP is disabled

BajaNivel 2Automatizadabottlerocket

Descripción

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP. The audit requires the sctp module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.sctp.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cómo se verifica

Método de auditoría: Comando de shell

shell

grep -qw '^sctp' /proc/modules 2>/dev/null && { echo 'sctp is loaded'; exit 1; }
o=$(modprobe -n -v sctp 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.sctp.allowed 2>/dev/null) || { echo 'sctp can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'sctp is allowed'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to disable the sctp module: # apiclient set kernel.modules.sctp.allowed=false

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketnetwork
Referencia: CIS Bottlerocket Benchmark v1.0.0 - 3.3.1 Ensure SCTP is disabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bottlerocket --level 2