3.5.2.6 Ensure nftables loopback traffic is configured - lo

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network

Rationale:

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

NOTE: Nessus has determined that this check is not applicable to the target device as it is currently configured. Please review the benchmark to ensure target compliance.

Solution

Run the following commands to implement the loopback rules:

# nft add rule inet filter input iif lo accept

# nft create rule inet filter input ip saddr 127.0.0.0/8 counter drop

IF IPv6 is enabled on the system:
Run the following command to implement the IPv6 loopback rule:

# nft add rule inet filter input ip6 saddr ::1 counter drop

See Also

https://workbench.cisecurity.org/files/3208