Detections
Analytics
3.3.2.1 Ensure net.ipv6.conf.all.forwarding is configured
Information
The net.ipv6.conf.all.forwarding flag tells the system whether it can forward IPv6 packets or not.Note: If IPv6 has been disabled, or this system is a router, this recommendation is not applicable.
Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.
Setting net.ipv6.conf.all.forwarding to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will not be able to forward IPv6 packets.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv6.conf.all.forwarding lines that are not net.ipv6.conf.all.forwarding=0.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv6.conf.all.forwarding" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Pio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Poi -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Pivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv6.conf.all.forwarding = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv6.conf.all.forwarding = 0" >> /etc/sysctl.d/60-ipv6_sysctl.conf
Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.
Many Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding.
See Also
Item Details
Audit Name: CIS AlmaLinux OS 10 v1.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CSCv7|9.2
Plugin: Unix
Control ID: adca5fb8cb4f0be5a2b5dcb0cb7f6a2cd38bb20eccabc26a10fe827d0af304a8