Detections
Analytics

4.3.2.7 Ensure multicast routing is not in use

Information

The mrouted daemon is an implementation of the multicast routing protocol.

Unless a system is specifically set up to act as a network router, it is recommended that the mrouted daemon is disabled to reduce the potential attack surface.

Solution

Run the following script to stop and disable mrouted

#!/usr/bin/ksh
DAEMONS="mrouted"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

NOTE: mrouted is provided by bos.net.tcp.server_core so it is not possible to remove this fileset.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215359r958478_rule, Vuln-ID|V-215359

Plugin: Unix

Control ID: e4fd2d928f092f4ad07ee9567e1fd8b739b14705c8226f64ed628e5f0f85700c