Detections
Analytics

4.1.5 Ensure firewalld loopback traffic is configured

Information

Every device with networking capabilities has a loopback interface.

Loopback traffic refers to network communication where a device sends data to itself, essentially routing the traffic back to its own network interface.

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

Solution

- Run one of the following commands to add the lo interface to the trusted zone.

If the lo interface is not currently assigned to a zone:

# firewall-cmd --permanent --zone=trusted --add-interface=lo

- OR - if the lo interface is currently assigned to a zone:

# firewall-cmd --permanent --zone=trusted --change-interface=lo

 - Run the following command to reload firewalld:

# firewall-cmd --reload

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 2ec2de1260195780bdc0291f7a9831ad7748a9dd893968605aa411970e8d21c1