cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.4.2.9
Description
The nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service.
Rationale
The nftables service restores the nftables rules from the rules files referenced in the /etc/nftables.conf file during boot or the starting of the nftables service.
Impact
None.
Audit Procedure
Command Line
Run the following command and verify that the nftables service is enabled:
systemctl is-enabled nftables
Expected Result
enabled
Remediation
Command Line
Run the following command to enable the nftables service:
systemctl enable nftables
Default Value
nftables service is disabled by default.
References
- NIST SP 800-53 Rev. 5: CA-9, SC-7
- CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
CIS Controls
Version 8
4.4 Implement and Manage a Firewall on Servers - Implement and manage a firewall on servers, where supported.
4.5 Implement and Manage a Firewall on End-User Devices - Implement and manage a host-based firewall or port-filtering tool on end-user devices.
Version 7
9.4 Apply Host-based Firewalls or Port Filtering - Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated