Ensure SCTP is disabled

낮음레벨 2자동bottlerocket

설명

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP. The audit requires the sctp module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.sctp.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).

점검 방법

감사 방식: 셸 명령

shell

grep -qw '^sctp' /proc/modules 2>/dev/null && { echo 'sctp is loaded'; exit 1; }
o=$(modprobe -n -v sctp 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.sctp.allowed 2>/dev/null) || { echo 'sctp can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'sctp is allowed'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following command to disable the sctp module: # apiclient set kernel.modules.sctp.allowed=false

속성

운영 체제: 모두
태그: bottlerocketnetwork
참고 자료: CIS Bottlerocket Benchmark v1.0.0 - 3.3.1 Ensure SCTP is disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target bottlerocket --level 2