Detections
Analytics

3.5.4 Ensure IP tunnels are not configured

Information

The operating system must not have unauthorized IP tunnels configured.

IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the the Authorizing Official of the organization.

Solution

Remove all unapproved tunnels from the system, or document them with the Authorizing Official.

To remove them edit the /etc/ipsec.conf and /etc/ipsec.d/*.conf files removing any lines indicating a conn parameter is configured.

Example: vim /etc/ipsec.conf

Remove and lines with a "conn" parameter set.

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, CSCv7|9.4, Rule-ID|SV-204629r603261_rule, STIG-ID|RHEL-07-040820, Vuln-ID|V-204629

Plugin: Unix

Control ID: a9d1b24f9194244e46adb27a5d93607e58faeab452aca4f02eaf7d52d0b756a4