Ensure SCTP is disabled

DüşükDüzey 2Otomatikbottlerocket

Açıklama

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP. The audit requires the sctp module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.sctp.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

grep -qw '^sctp' /proc/modules 2>/dev/null && { echo 'sctp is loaded'; exit 1; }
o=$(modprobe -n -v sctp 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.sctp.allowed 2>/dev/null) || { echo 'sctp can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'sctp is allowed'

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Run the following command to disable the sctp module: # apiclient set kernel.modules.sctp.allowed=false

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: bottlerocketnetwork
Referans: CIS Bottlerocket Benchmark v1.0.0 - 3.3.1 Ensure SCTP is disabled

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target bottlerocket --level 2