Detections
Analytics

1.114 SOL-11.1-040490

Information

The operating system must prevent remote devices that have established a non-remote connection with the system from communicating outside of the communication path with resources in external networks.

GROUP ID: V-216129RULE ID: SV-216129r959010

This control enhancement is implemented within the remote device (e.g., notebook/laptop computer) via configuration settings not configurable by the user of the device. An example of a non-remote communications path from a remote device is a virtual private network. When a non-remote connection is established using a virtual private network, the configuration settings prevent split-tunneling. Split-tunneling might otherwise be used by remote users to communicate with the information system as an extension of the system and to communicate with local resources, such as a printer or file server. The remote device, when connected by a non-remote connection, becomes an extension of the information system allowing dual communications paths, such as split-tunneling, in effect allowing unauthorized external connections into the system. This is a split-tunneling requirement that can be controlled via the operating system by disabling interfaces.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

The root Role is required.

Remove net_access privilege from users who may be accessing the systems externally.

 - Create an RBAC Profile with net_access restriction

profiles -p RestrictOutboundprofiles:RestrictOutbound> set desc="Restrict Outbound Connections"profiles:RestrictOutbound> set limitpriv=zone,!net_accessprofiles:RestrictOutbound> exit

 - Assign the RBAC Profile to a user

usermod -P +RestrictOutbound [username]

This prevents the user from initiating any outbound network connections.

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216129r959010_rule, STIG-ID|SOL-11.1-040490, Vuln-ID|V-216129

Plugin: Unix

Control ID: 4e3e2eaf077259705eb81865b8371af2f5960310989aa5354705d973cc07676d