cyberstrikeus 7.2.6 Enable Bad Error Message Protection (Scored)
Profile Applicability
- Level 1
Description
Setting icmp_ignore_bogus_error_responses to 1 prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages.
Rationale
Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages.
Audit Procedure
Using Command Line
Perform the following to determine if bogus messages will be ignored.
/sbin/sysctl net.ipv4.icmp_ignore_bogus_error_responses
Expected Result
net.ipv4.icmp_ignore_bogus_error_responses = 1
Remediation
Using Command Line
Set the net.ipv4.icmp_ignore_bogus_error_responses parameter to 1 in /etc/sysctl.conf:
net.ipv4.icmp_ignore_bogus_error_responses=1
Modify active kernel parameters to match:
/sbin/sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
/sbin/sysctl -w net.ipv4.route.flush=1
Default Value
Bogus error message protection is disabled by default.
References
- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored