Ensure SCTP is disabled

FaibleNiveau 2Automatiséebottlerocket

Description

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP. The audit requires the sctp module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.sctp.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).

Méthode de vérification

Méthode d'audit: Commande shell

shell

grep -qw '^sctp' /proc/modules 2>/dev/null && { echo 'sctp is loaded'; exit 1; }
o=$(modprobe -n -v sctp 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.sctp.allowed 2>/dev/null) || { echo 'sctp can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'sctp is allowed'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following command to disable the sctp module: # apiclient set kernel.modules.sctp.allowed=false

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: bottlerocketnetwork
Référence: CIS Bottlerocket Benchmark v1.0.0 - 3.3.1 Ensure SCTP is disabled

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target bottlerocket --level 2