Detections
Analytics
3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured
Information
ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.net.ipv4.conf.default.send_redirects controls sending of all IPv4 ICMP redirected packets on a newly added network interface.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.send_redirects lines that are not net.ipv4.conf.default.send_redirects=0.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.default.send_redirects" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.send_redirects = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.send_redirects = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
Note: See the Configure IPv4 parameters subsection overview for important notes on UFW sysctl file interaction.
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.
See Also
Item Details
Audit Name: CIS Debian Linux 13 v1.1.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: 28c2fa3593c52ec368c243857d43ddfec5ef7230b1177262cc2274ae9efd0d83