Detections
Analytics
3.3.1.16 Ensure net.ipv4.conf.all.log_martians is configured
Information
When enabled, this feature logs packets with un-routable source addresses to the kernel log.net.ipv4.conf.all.log_martians controls if IPv4 packets with un-routable source addresses on any network interface is logged to the kernel log.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Setting net.ipv4.conf.all.log_martians to 1 enables this feature. Logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.all.log_martians lines that are not net.ipv4.conf.all.log_martians=1.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.all.log_martians" l_value="1"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.all.log_martians = 1
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.all.log_martians = 1" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
Logging packets with impossible ("martian") source or destination addresses increases the volume of kernel log messages. On a busy or heavily spoofed network segment this can consume additional disk space and add noise to the logs.
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6b., CSCv7|6.2, CSCv7|6.3
Plugin: Unix
Control ID: 534a39a2c8bd2539ef92b4d8f38fe2bbc8dac1a307cfde3c1126d515cff693c8