cyberstrikeus CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 3.3.3
Description
Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure.
Rationale
It is still possible for even known gateways to be compromised. Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from routing table updates by possibly compromised known gateways.
Impact
None.
Audit Procedure
Command Line
Run the following commands and verify output matches:
sysctl net.ipv4.conf.all.secure_redirects
sysctl net.ipv4.conf.default.secure_redirects
grep "net\.ipv4\.conf\.all\.secure_redirects" /etc/sysctl.conf /etc/sysctl.d/*
grep "net\.ipv4\.conf\.default\.secure_redirects" /etc/sysctl.conf /etc/sysctl.d/*
Expected Result
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
And the grep commands should return:
net.ipv4.conf.all.secure_redirects= 0
net.ipv4.conf.default.secure_redirects= 0
Remediation
Command Line
Set the following parameters in /etc/sysctl.conf or a /etc/sysctl.d/* file:
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
Run the following commands to set the active kernel parameters:
sysctl -w net.ipv4.conf.all.secure_redirects=0
sysctl -w net.ipv4.conf.default.secure_redirects=0
sysctl -w net.ipv4.route.flush=1
Default Value
secure_redirects is enabled (set to 1) by default.
References
- CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
CIS Controls
Version 7
5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated