cyberstrikeus 7.1.2 Disable Send Packet Redirects (Scored)
Profile Applicability
- Level 1
Description
ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.
Rationale
An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system.
Audit Procedure
Using Command Line
Perform the following to determine if send packet redirects is disabled.
/sbin/sysctl net.ipv4.conf.all.send_redirects
/sbin/sysctl net.ipv4.conf.default.send_redirects
Expected Result
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
Remediation
Using Command Line
Set the net.ipv4.conf.all.send_redirects and net.ipv4.conf.default.send_redirects parameters to 0 in /etc/sysctl.conf:
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
Modify active kernel parameters to match:
/sbin/sysctl -w net.ipv4.conf.all.send_redirects=0
/sbin/sysctl -w net.ipv4.conf.default.send_redirects=0
/sbin/sysctl -w net.ipv4.route.flush=1
Default Value
Send redirects are enabled by default.
References
- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored