cyberstrikeus 3.1.2 Ensure packet redirect sending is disabled (Scored)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.
Rationale
An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system.
Audit Procedure
Run the following commands and verify output matches:
sysctl net.ipv4.conf.all.send_redirects
# Expected: net.ipv4.conf.all.send_redirects = 0
sysctl net.ipv4.conf.default.send_redirects
# Expected: net.ipv4.conf.default.send_redirects = 0
grep "net\.ipv4\.conf\.all\.send_redirects" /etc/sysctl.conf /etc/sysctl.d/*
# Expected: net.ipv4.conf.all.send_redirects = 0
grep "net\.ipv4\.conf\.default\.send_redirects" /etc/sysctl.conf /etc/sysctl.d/*
# Expected: net.ipv4.conf.default.send_redirects= 0
Expected Result
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
Remediation
Set the following parameters in /etc/sysctl.conf or a /etc/sysctl.d/* file:
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
Run the following commands to set the active kernel parameters:
sysctl -w net.ipv4.conf.all.send_redirects=0
sysctl -w net.ipv4.conf.default.send_redirects=0
sysctl -w net.ipv4.route.flush=1
Default Value
Not specified. Note: It has been reported that due to Ubuntu bug #50093 this setting (and some others) can fail to apply properly on reboot requiring it to be manually re-applied. One method of accomplishing this is to add sysctl -p to run on reboot to your systems crontab.
References
- CIS Controls: 3 - Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
- CIS Controls: 11 - Secure Configurations for Network Devices such as Firewalls, Routers and switches
Profile
- Level 1 - Server
- Level 1 - Workstation