Detections
Analytics
3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured
Information
ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.net.ipv4.conf.default.send_redirects controls sending of all IPv4 ICMP redirected packets on a newly added network interface.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Note: If this system is a router this recommendation is not applicable.
An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.send_redirects lines that are not net.ipv4.conf.default.send_redirects=0.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.default.send_redirects" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.send_redirects = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.send_redirects = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
A system acting as a router will no longer send ICMP redirect messages, so directly connected hosts may not be informed of a better first-hop route and could use a suboptimal path. Normal connectivity and packet forwarding are not affected.
See Also
Item Details
Audit Name: CIS Oracle Linux 9 v3.0.0 L1 Workstation
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: 1d579e335a27fbcc556e778cda062087ccfdfa696370313537d1a8d4a2b52028