Ensure net.ipv4.conf.all.forwarding is configured

보통레벨 1자동linux

설명

ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects. net.ipv4.conf.all.forwarding controls forwarding of IPv4 packet on all interfaces. More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview. Note: • If this system is a router this recommendation is not applicable. • If net.ipv4.ip_forward=0 is configured, this recommendation may be skipped.

점검 방법

감사 방식: 셸 명령

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk net.ipv4.conf.all.forwarding 0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Review all files being used by systemd-sysctl and comment out or remove all net.ipv4.conf.all.forwarding lines that are not net.ipv4.conf.all.forwarding=0. Example script: #!/usr/bin/env bash { l_option="net.ipv4.conf.all.forwarding" l_value="0" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\…

속성

운영 체제: rocky-9
태그: cis-convertedkernellinuxsysctl
참고 자료: CIS Rocky Linux 9 Benchmark v3.0.0 - 3.3.1.2

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux