Detections
Analytics

4.1.3 Ensure ufw incoming default is configured

Information

The default policy for incoming traffic determines if connections attempting to reach your server from external sources will be allowed without requiring specific UFW rules.

With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage.

Solution

Run the following command to set the default for incoming to deny :

# ufw default deny incoming

Warning: Any port or protocol without a explicit allow before the default deny will be blocked.

Impact:

Any port or protocol without a explicit allow before the default deny will be blocked. A deny policy silently drops packs causing an eventual time out with no response while a 'reject' policy sends an immediate and explicit "connection refused" or "destination unreachable" message in response.

The following is and example of a command to create a rule to allow connection to the ssh server on the host. This rule should be considered before applying the default deny.

Example:

# ufw allow ssh

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: a50d9923d2c22272cbb4f2e381224a837c7b8879dc18c17c1450fa6ad80dc78d