Detections
Analytics

1.416 RHEL-10-800150

Information

RHEL 10 must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.

GROUP ID: V-281347RULE ID: SV-281347r1167191

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It must be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.

Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00078

Solution

Configure RHEL 10 to not forward IPv4 source-routed packets by default.

Create a configuration file if it does not already exist:

$ sudo vi /etc/sysctl.d/99-ipv4_accept_source_route.conf

Add the following line to the file:

net.ipv4.conf.default.accept_source_route = 0

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, 800-53|SC-7(4), CAT|II, CCI|CCI-001102, CCI|CCI-002385, Rule-ID|SV-281347r1167191_rule, STIG-ID|RHEL-10-800150, Vuln-ID|V-281347

Plugin: Unix

Control ID: 08bdabc6f9a75d26ed935acd1e33a260717f4d282d51926e13c6ec242a3b6a5b