Detections
Analytics

1.419 RHEL-10-800180

Information

RHEL 10 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.

GROUP ID: V-281350RULE ID: SV-281350r1167200

Some routers will send responses to broadcast frames that violate RFC-1122, which fills up a log file system with many useless error messages. An attacker may take advantage of this and attempt to flood the logs with bogus error logs. Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.

Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00081

Solution

Configure RHEL 10 to not log bogus ICMP errors.

Create a configuration file if it does not already exist:

$ sudo vi /etc/sysctl.d/ipv4_icmp_ignore_bogus_error_responses.conf

Add the following line to the file:

net.ipv4.icmp_ignore_bogus_error_responses = 1

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, 800-53|SC-7(4), CAT|II, CCI|CCI-001105, CCI|CCI-002385, Rule-ID|SV-281350r1167200_rule, STIG-ID|RHEL-10-800180, Vuln-ID|V-281350

Plugin: Unix

Control ID: 539823b0e762ead96d424dc633080f5b0fef63463f779b3e75b7308d36d693e5