Ensure net.ipv4.conf.default.accept_redirects is configured

中レベル 1自動linux

説明

ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. net.ipv4.conf.default.accept_redirects controls accepting of all IPv4 ICMP redirected packets on a newly added network interface. More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview. Note: If this system is a router this recommendation is not

チェック方法

監査方法: シェルコマンド

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv4.conf.default.accept_redirects 0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.accept_redirects lines that are not net.ipv4.conf.default.accept_redirects=0. Example script: #!/usr/bin/env bash { l_option="net.ipv4.conf.default.accept_redirects" l_value="0" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -P…

プロパティ

オペレーティングシステム: rocky-9
タグ: cis-convertedkernellinuxsysctl
参照: CIS Rocky Linux 9 Benchmark v3.0.0 - 3.3.1.9

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux