Detections
Analytics
3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured
Information
ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables.net.ipv4.conf.default.accept_redirects controls accepting of all IPv4 ICMP redirected packets on a newly added network interface.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Note: If this system is a router this recommendation is not applicable.
ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables.
By setting net.ipv4.conf.all.accept_redirects to 0, the system will not accept IPv4 ICMP redirect messages on a newly added network interface.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.accept_redirects lines that are not net.ipv4.conf.default.accept_redirects=0.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.default.accept_redirects" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.accept_redirects = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.accept_redirects = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
- Run the following command to load all sysctl configuration filles:
# sysctl --system
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: 4d4c599c42091a6dfbeb76080fc825365395e956b578326d41ceb29b04a473be