Detections
Analytics

3.3.1.19 Ensure net.ipv4.conf.lo.route_localnet is configured

Information

The net.ipv4.conf.lo.route_localnet flag enables the use of 127/8 for local routing purposes and tells the system do not consider loopback addresses as martian source or destination while routing.

More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.

Note: If this system is a router this recommendation is not applicable.

Setting net.ipv4.conf.lo.route_localnet to 0 enforces network isolation by preventing external interfaces from routing traffic to loopback addresses.

Solution

Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.lo.route_localnet lines that are not net.ipv4.conf.lo.route_localnet = 0.

Example script

#!/usr/bin/env bash

{
 l_option="net.ipv4.conf.lo.route_localnet" l_value="0"
 l_grep="${l_option//./(\\.|\\/)}" a_files=()
 l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
 || readlink -e /usr/lib/systemd/systemd-sysctl)"
 l_ufw_file="$([ -f /etc/default/ufw ] && \
 awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
 [ -f "$(readlink -e "$l_ufw_file")" ] && \
 a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
 while IFS= read -r l_fname; do
 l_file="$(readlink -e "${l_fname//# /}")"
 [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
 <<< "${a_files[*]}" && a_files+=("$l_file")
 done < <("$l_systemdsysctl" --cat-config | tac | \
 grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
 for l_file in "${a_files[@]}"; do
 grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
 | grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
 sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
 done
}

Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.lo.route_localnet = 0

Example

# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.lo.route_localnet = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

Run the following command to load all sysctl configuration filles:

# sysctl --system

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 15bdb4e10bb8c2e50775cf51178a4687272d69255f1a23781b6ed1a674a0c2cb