TMA-ROCKY8-3.3.1.13

Ensure net.ipv4.conf.default.rp_filter is configured

보통레벨 1자동linux

설명

net.ipv4.conf.default.rp_filter controls reverse path filtering for IPv4 traffic on newly added network interfaces. Reverse path filtering is a security mechanism in Linux that helps prevent IP spoofing and other network attacks. When enabled, it checks if the source IP address of an incoming packet is reachable through the same network interface it was received on. If the packet's source address is not reachable through the interface it arrived on, the packet is dropped. Note: If this system is a router, and uses asymmetrical routing, this recommendation is not applicable.

점검 방법

감사 방식: 셸 명령

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv4.conf.default.rp_filter 1; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.rp_filter lines that are not net.ipv4.conf.default.rp_filter=1. Example script: #!/usr/bin/env bash { l_option="net.ipv4.conf.default.rp_filter" l_value="1" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" l_ufw_file="$([ -f /etc/default/ufw ] && \ awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)" [ -f "$(readlink -e "$l_ufw_file")" ] && \ a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file"…

속성

운영 체제: rocky-8
태그: cis-convertedkernellinuxsysctl
참고 자료: CIS Rocky Linux 8 Benchmark v3.0.0 - 3.3.1.13

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux