Check: GEN008540
HP-UX 11.31 STIG:
GEN008540
(in versions v1 r19 through v1 r13)
Title
The system's local firewall must implement a deny-all, allow-by-exception policy. (Cat II impact)
Discussion
A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.
Check Content
Check the firewall rules for a default deny rule. # ipfstat -i | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep "block" An example of a default deny rule: block in log quick on ne3 from any to any If there is no default deny rule, this is a finding.
Fix Text
Edit /etc/opt/ipf/ipf.conf and add a default deny rule and restart the ipfilter service. # /sbin/init.d/ipfboot stop # /sbin/init.d/ipfboot start
Additional Identifiers
Rule ID: SV-26977r1_rule
Vulnerability ID: V-22583
Group Title: GEN008540
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001109 |
The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception). |
Controls
Number | Title |
---|---|
SC-7 (5) |
Deny By Default / Allow By Exception |