Detections
Analytics
3.3.5 Ensure icmp redirects are not accepted
Information
ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables.ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting net.ipv4.conf.all.accept_redirects, net.ipv4.conf.default.accept_redirects, net.ipv6.conf.all.accept_redirects, and net.ipv6.conf.default.accept_redirects to 0, the system will not accept any ICMP redirect messages, and therefore, won't allow outsiders to update the system's routing tables.
Solution
Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf :- net.ipv4.conf.all.accept_redirects = 0
- net.ipv4.conf.default.accept_redirects = 0
Example:
# printf '%s\n' "net.ipv4.conf.all.accept_redirects = 0" "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.d/60-netipv4_sysctl.conf
Run the following script to set the active kernel parameters:
#!/usr/bin/env bash
{
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.default.accept_redirects=0
sysctl -w net.ipv4.route.flush=1
}
- IF - IPv6 is enabled on the system:
Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf :
- net.ipv6.conf.all.accept_redirects = 0
- net.ipv6.conf.default.accept_redirects = 0
Example:
# printf '%s\n' "net.ipv6.conf.all.accept_redirects = 0" "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.d/60-netipv6_sysctl.conf
Run the following script to set the active kernel parameters:
#!/usr/bin/env bash
{
sysctl -w net.ipv6.conf.all.accept_redirects=0
sysctl -w net.ipv6.conf.default.accept_redirects=0
sysctl -w net.ipv6.route.flush=1
}
Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten
See Also
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CAT|II, CSCv7|9.2, Rule-ID|SV-230535r858793_rule, Rule-ID|SV-230544r858820_rule, Rule-ID|SV-230550r627750_rule, Rule-ID|SV-230553r809324_rule, STIG-ID|RHEL-08-040210, STIG-ID|RHEL-08-040280, STIG-ID|RHEL-08-040290, STIG-ID|RHEL-08-040320, Vuln-ID|V-230535, Vuln-ID|V-230544, Vuln-ID|V-230550, Vuln-ID|V-230553
Plugin: Unix
Control ID: bc53a4e3d70e08fa2bbc98f8ec599c7b38965d65c4a600fa1344da56bd2c0495