Detections
Analytics

3.3.1.20 Ensure net.ipv4.conf.default.route_localnet is configured

Information

The net.ipv4.conf.default.route_localnet flag sets, for newly added network interfaces, whether the system may use 127/8 for local routing purposes; when set to 0 the system continues to treat loopback addresses as martian source or destination while routing.

More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.

Setting net.ipv4.conf.default.route_localnet to 0 enforces network isolation for newly added interfaces by preventing external interfaces from routing traffic to loopback addresses.

Solution

Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.route_localnet lines that are not net.ipv4.conf.default.route_localnet = 0.

Example script

#!/usr/bin/env bash

{
 l_option="net.ipv4.conf.default.route_localnet" l_value="0"
 l_grep="${l_option//./(\\.|\\/)}" a_files=()
 l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
 || readlink -e /usr/lib/systemd/systemd-sysctl)"
 a_files+=("/etc/sysctl.conf")
 while IFS= read -r l_fname; do
 l_file="$(readlink -e "${l_fname//# /}")"
 [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
 <<< "${a_files[*]}" && a_files+=("$l_file")
 done < <("$l_systemdsysctl" --cat-config | tac | \
 grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
 for l_file in "${a_files[@]}"; do
 grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
 | grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
 sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
 done
}

Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.route_localnet = 0

Example

# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.route_localnet = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf

Run the following command to load all sysctl configuration files:

# sysctl --system

Impact:

Enforcing net.ipv4.conf.default.route_localnet = 0 prevents newly added interfaces from routing or forwarding traffic destined to 127/8 . On systems that legitimately require this - for example a router, or a container/Kubernetes host where kube-proxy (or similar) sets route_localnet=1 - this recommendation may not be applicable; assess and document any such exception before enforcing.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-6, 800-53|CM-7, 800-53|SC-7, CSCv7|9.2

Plugin: Unix

Control ID: 2da0964cf00bd9bd161e76ec853998c08f0f2fd66b950605d52101eb6b588df3