Detections
Analytics

3.2.4 Ensure sctp kernel module is not available

Information

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Removing support for unneeded protocols reduces the local attack surface of the system. If this protocol is not needed, disable it.

Solution

Unload and disable the sctp kernel module.

 - Run the following commands to unload the sctp kernel module:

# modprobe -r sctp 2>/dev/null
# rmmod sctp 2>/dev/null

 - Perform the following to disable the sctp kernel module:

Create a file ending in .conf with install sctp /bin/false in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "install sctp /bin/false" >> /etc/modprobe.d/60-sctp.conf

Create a file ending in .conf with blacklist sctp in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "blacklist sctp" >> /etc/modprobe.d/60-sctp.conf

Impact:

The Stream Control Transmission Protocol (SCTP) is used by some telephony and signaling stacks (for example SS7 and Diameter). Disabling the sctp kernel module has no operational impact unless an application on the system requires SCTP.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 6724cedf74577089bfc8221c8617f5973c874d925d207a3ed68c57c97de4e373