Detections
Analytics
GEN005610 - The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router - 'net.ipv6.conf.all.forwarding'
Information
If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.Solution
Disable IPv6 forwarding.Edit /etc/sysctl.conf and add a setting for 'net.ipv6.conf.all.forwarding=0' and 'net.ipv6.conf.default.forwarding=0'.
Reload the sysctls.
Procedure:
# sysctl -p
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip
Item Details
Audit Name: DISA STIG for Oracle Linux 5 v2r1
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-218624r603259_rule, STIG-ID|GEN005610, STIG-Legacy|SV-64245, STIG-Legacy|V-22491, Vuln-ID|V-218624
Plugin: Unix
Control ID: 6cc0f232be8e53add6e07fe73832211f9716a1fb6e2e0575409c8c35e9050a8a