cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.4.2.10
Description
nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.
The nftables service reads the /etc/nftables.conf file for a nftables file or files to include in the nftables ruleset.
A nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.
Rationale
Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot.
Impact
None.
Audit Procedure
Command Line
Run the following commands to verify that input, forward, and output base chains are configured to be applied to a nftables ruleset on boot:
Run the following command to verify the input base chain:
[ -n "$(grep -E '^\s*include' /etc/nftables.conf)" ] && awk '/hook input/,/}/' $(awk '$1 ~ /^\s*include/ { gsub("\"","",$2);print $2 }' /etc/nftables.conf)
Run the following command to verify the forward base chain:
[ -n "$(grep -E '^\s*include' /etc/nftables.conf)" ] && awk '/hook forward/,/}/' $(awk '$1 ~ /^\s*include/ { gsub("\"","",$2);print $2 }' /etc/nftables.conf)
Run the following command to verify the output base chain:
[ -n "$(grep -E '^\s*include' /etc/nftables.conf)" ] && awk '/hook output/,/}/' $(awk '$1 ~ /^\s*include/ { gsub("\"","",$2);print $2 }' /etc/nftables.conf)
Review each base chain to ensure that it follows local site policy.
Expected Result
Each command should return the corresponding base chain configuration with rules matching site policy.
Remediation
Command Line
Edit the /etc/nftables.conf file and un-comment or add a line with include <Absolute path to nftables rules file> for each nftables file you want included in the nftables ruleset on boot.
Example:
vi /etc/nftables.conf
Add the line:
include "/etc/nftables.rules"
Default Value
No nftables rules are permanent by default.
References
- NIST SP 800-53 Rev. 5: CA-9, SC-7
- CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
CIS Controls
Version 8
4.4 Implement and Manage a Firewall on Servers - Implement and manage a firewall on servers, where supported.
4.5 Implement and Manage a Firewall on End-User Devices - Implement and manage a host-based firewall or port-filtering tool on end-user devices.
Version 7
9.4 Apply Host-based Firewalls or Port Filtering - Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated