Detections
Analytics
3.3.1.6 Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured
Information
net.ipv4.icmp_ignore_bogus_error_responses controls if the kernel logs bogus responses (RFC-1122 non-compliant) from broadcast reframes.More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.icmp_ignore_bogus_error_responses lines that are not net.ipv4.icmp_ignore_bogus_error_responses=1.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.icmp_ignore_bogus_error_responses" l_value="1"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.icmp_ignore_bogus_error_responses = 1
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.icmp_ignore_bogus_error_responses = 1" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
- Run the following command to load all sysctl configuration filles:
# sysctl --system
See Also
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: c93c25c3d08bee5ec97ab104c8d7688f5b54492ed37cec788e3e2e2532b03a70