Detections
Analytics

4.1.10 Ensure firewalld logs denied packets

Information

The LogDenied option in /etc/firewalld/firewalld.conf controls logging of packets denied (dropped or rejected) by firewalld . Supported values are off (default), all, unicast, broadcast, and multicast . When enabled, firewalld adds kernel logging rules for denied packets immediately before the applicable reject/drop rules.

Logging denied packets provides visibility into blocked and attempted connections, supporting detection of firewall misconfigurations and malicious activity, and providing evidence for incident investigation.

Solution

Run the following command to enable logging of denied packets (replace all with the value that meets local site policy):

# firewall-cmd --set-log-denied=all

Run the following command to reload firewalld:

# firewall-cmd --reload

Impact:

Enabling LogDenied increases the volume of kernel/firewall log messages; ensure log rotation and storage are sized appropriately, as high-traffic or heavily-probed hosts can generate a large number of entries.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: 9cdc5b8418c38d6ad0649482e9d22fddd33940359dd8dcbefbc2291a668fde1b