cyberstrikeus 3.2.4 Ensure suspicious packets are logged (Scored)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
When enabled, this feature logs packets with un-routable source addresses to the kernel log.
Rationale
Enabling this feature and logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.
Audit Procedure
Run the following commands and verify output matches:
sysctl net.ipv4.conf.all.log_martians
# Expected: net.ipv4.conf.all.log_martians = 1
sysctl net.ipv4.conf.default.log_martians
# Expected: net.ipv4.conf.default.log_martians = 1
grep "net\.ipv4\.conf\.all\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*
# Expected: net.ipv4.conf.all.log_martians = 1
grep "net\.ipv4\.conf\.default\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*
# Expected: net.ipv4.conf.default.log_martians = 1
Expected Result
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
Remediation
Set the following parameters in /etc/sysctl.conf or /etc/sysctl.d/* file:
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
Run the following commands to set the active kernel parameters:
sysctl -w net.ipv4.conf.all.log_martians=1
sysctl -w net.ipv4.conf.default.log_martians=1
sysctl -w net.ipv4.route.flush=1
Default Value
Not specified. Note: It has been reported that due to Ubuntu bug #50093 this setting (and some others) can fail to apply properly on reboot requiring it to be manually re-applied. One method of accomplishing this is to add sysctl -p to run on reboot to your systems crontab.
References
- CIS Controls: 6 - Maintenance, Monitoring, and Analysis of Audit Logs
Profile
- Level 1 - Server
- Level 1 - Workstation