Ensure net.ipv6.conf.default.accept_redirects is configured

보통레벨 1자동linux

설명

ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. net.ipv6.conf.default.accept_redirects controls accepting of all IPv6 ICMP redirected packets on a newly added network interface. Note: If IPv6 has been disabled, or this system is a router, this recommendation is not applicable.

점검 방법

감사 방식: 셸 명령

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv6.conf.default.accept_redirects 0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Review all files being used by systemd sysctl and comment out or remove all net.ipv6.conf.default.accept_redirects lines that are not net.ipv6.conf.default.accept_redirects=0. Example script: #!/usr/bin/env bash { l_option="net.ipv6.conf.default.accept_redirects" l_value="0" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" l_ufw_file="$([ -f /etc/default/ufw ] && \ awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)" [ -f "$(readlink -e "$l_ufw_file")" ] && \ a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//#…

속성

운영 체제: almalinux-8
태그: cis-convertedkernellinuxsysctl
참고 자료: CIS AlmaLinux OS 8 Benchmark v4.0.0 - 3.3.2.4

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux