Check: OL6-00-000089
Oracle Linux 6 STIG:
OL6-00-000089
(in versions v2 r7 through v1 r9)
Title
The system must not accept IPv4 source-routed packets by default. (Cat II impact)
Discussion
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
Check Content
The status of the "net.ipv4.conf.default.accept_source_route" kernel parameter can be queried by running the following command: $ sysctl net.ipv4.conf.default.accept_source_route The output of the command should indicate a value of "0". If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in "/etc/sysctl.conf". $ grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf If the correct value is not returned, this is a finding.
Fix Text
To set the runtime status of the "net.ipv4.conf.default.accept_source_route" kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.accept_source_route=0 If this is not the system's default value, add the following line to "/etc/sysctl.conf": net.ipv4.conf.default.accept_source_route = 0
Additional Identifiers
Rule ID: SV-208857r793642_rule
Vulnerability ID: V-208857
Group Title: SRG-OS-000480
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |