Detections
Analytics

3.3.4 Ensure icmp redirects are not accepted

Information

ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables.

ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting net.inet.icmp.drop_redirect to 1 and net.inet6.icmp6.rediraccept to 0, the system will not accept any ICMP redirect messages, and therefore, won't allow outsiders to update the system's routing tables.

Solution

Set the following parameters in /etc/sysctl.conf :

 - net.inet.icmp.drop_redirect=1

Example:

# printf "
net.inet.icmp.drop_redirect: 1
" >> /etc/sysctl.conf

Run the following command to set the active kernel parameters:

# sysctl net.inet.icmp.drop_redirect=1

-IF- IPv6 is enabled on the system:

Set the following parameters in /etc/sysctl.conf :

 - net.inet6.ip6.redirect=0

Example:

# printf "
net.inet6.icmp6.rediraccept: 0
" >> /etc/sysctl.conf

Run the following command to set the active kernel parameters:

# sysctl net.inet6.icmp6.rediraccept=0

Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|9.2

Plugin: Unix

Control ID: 7fdcfee5b847b9261b1904331167df9c6958c02ceaf6259fa760a2fbd032e891