Detections
Analytics

4.1.8 Ensure firewalld default zone is set to drop

Information

firewalld should be set to deny all traffic by default.

A deny-all default reduces the host attack surface. With the default zone set to drop, incoming traffic on any interface not assigned to another zone is dropped unless it is explicitly permitted, so only intended services are reachable.

Solution

Run the following to set the drop zone as the default.

# firewall-cmd --set-default-zone=drop

Reload firewalld for changes to take effect

# firewall-cmd --reload

Impact:

Setting the default zone to drop causes incoming traffic on interfaces not assigned to another zone to be dropped unless explicitly allowed; required services (including remote administration such as SSH) must be permitted or connectivity can be lost. Outbound traffic is not affected by the default zone.

Note: Configuration of a live system's firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 8df4a3ae00be6a75822ba064d374a6b15180fd4e75892b8726afe2f1573c0b8c