Detections
Analytics

4.1.11 Ensure firewalld blocks ICMP timestamp requests and replies

Information

ICMP timestamp messages ( timestamp-request, ICMP type 13, and timestamp-reply, ICMP type 14) allow a remote host to query the system clock. firewalld can block these message types, per zone, so the host does not respond to timestamp requests.

Answering ICMP timestamp requests discloses the host's system clock, which can help an attacker fingerprint the host, correlate activity across hosts, or attack time-dependent protocols. Vulnerability scanners commonly flag hosts that respond to ICMP timestamp requests. Blocking these ICMP types removes the disclosure.

Solution

Block the ICMP timestamp message types on each active zone that filters network traffic (target default ). A zone whose target is ACCEPT (such as trusted ) or DROP / %%REJECT%% already handles these messages and needs no change.

 - For each such zone, block both message types:

# firewall-cmd --permanent --zone=<ZONE> --add-icmp-block=timestamp-request
# firewall-cmd --permanent --zone=<ZONE> --add-icmp-block=timestamp-reply

 - Reload firewalld to apply the change:

# firewall-cmd --reload

Example (blocking on the public zone):

# firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-request
# firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-reply
# firewall-cmd --reload

Impact:

ICMP timestamp messages are rarely used by legitimate applications, so blocking them typically has no operational effect. Diagnostic tools that rely on ICMP timestamp (uncommon) will no longer function.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 91185155ab2635b1ad0aef1623756401dc0115ee60f767f27f602ec5dfd02e3d