cyberstrikeus 3.6.5 Ensure firewall rules exist for all open ports (Scored)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.
Rationale
Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports.
Audit Procedure
Run the following command to determine open ports:
netstat -ln
# Example output:
# Active Internet connections (only servers)
# Proto Recv-Q Send-Q Local Address Foreign Address State
# tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
Run the following command to determine firewall rules:
iptables -L INPUT -v -n
# Example output:
# Chain INPUT (policy DROP 0 packets, 0 bytes)
# pkts bytes target prot opt in out source destination
# 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
# 0 0 DROP all -- * * 127.0.0.0/8 0.0.0.0/0
# 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
# tcp dpt:22 state NEW
Verify all open ports listening on non-localhost addresses have at least one firewall rule.
Expected Result
All open ports listening on non-localhost addresses should have at least one corresponding firewall rule.
Remediation
For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:
iptables -A INPUT -p <protocol> --dport <port> -m state --state NEW -j ACCEPT
Default Value
Not configured. Note: Changing firewall settings while connected over network can result in being locked out of the system. Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well. The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy.
References
- CIS Controls: 9.1 - Limit Open Ports, Protocols, and Services
- CIS Controls: 9.2 - Leverage Host-based Firewalls
Profile
- Level 1 - Server
- Level 1 - Workstation