Detections
Analytics

4.1.7 Ensure firewalld services and ports are configured

Information

firewalld controls which traffic a zone allows by permitting named services (predefined protocol/port groups such as ssh or dhcpv6-client ) and individual ports . Traffic that is not matched by an allowed service or port is handled by the zone's target (accept, reject, or drop). Only the services and ports required for the system's role should be permitted, keeping the exposed attack surface to a minimum.

To reduce the attack surface of a system, all services and ports should be blocked unless required

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following command to remove an unnecessary service:

# firewall-cmd --remove-service=<service>

Example:

# firewall-cmd --remove-service=cockpit

Run the following command to remove an unnecessary port:

# firewall-cmd --remove-port=<port-number>/<port-type>

Example:

# firewall-cmd --remove-port=25/tcp

Run the following command to make new settings persistent:

# firewall-cmd --runtime-to-permanent

Impact:

Removing a service or port that is required for the system's role will break access to it. Confirm each permitted service and port against site policy before removing, and validate that remote access (such as SSH) is retained.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: a3a8bddc256b894642a9614328b5eedb30eeea04cd46fec0d418a5a3c1255288