Detections
Analytics
3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured
Information
net.ipv4.conf.default.rp_filter controls reverse path filtering for IPv4 traffic on newly added network interfaces.Reverse path filtering is a security mechanism in Linux that helps prevent IP spoofing and other network attacks. When enabled, it checks if the source IP address of an incoming packet is reachable through the same network interface it was received on. If the packet's source address is not reachable through the interface it arrived on, the packet is dropped.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Setting net.ipv4.conf.default.rp_filter to 1 is a good way to deter attackers from sending your system bogus packets that cannot be responded to. One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.rp_filter lines that are not net.ipv4.conf.default.rp_filter=1.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.default.rp_filter" l_value="1"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.rp_filter = 1
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.rp_filter = 1" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
Note: See the Configure IPv4 parameters subsection overview for important notes on UFW sysctl file interaction.
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.
See Also
Item Details
Audit Name: CIS Debian Linux 13 v1.1.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: edd36b8b8be60a8bb7a418adb852faebf99b4a8dda04901de094516a5640eb8a