Detections
Analytics
GEN007920 - The system must not forward IPv6 source-routed packets - 'net.ipv6.conf.all.forwarding'
Information
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.Solution
Configure the system to not forward IPv6 source-routed packets.Procedure:
Edit the /etc/sysctl.conf file to include:
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0
Reload the kernel parameters:
# sysctl -p
See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|II, CCI|CCI-001551, Group-ID|V-22553, Rule-ID|SV-37618r1_rule, STIG-ID|GEN007920, Vuln-ID|V-22553
Plugin: Unix
Control ID: a653acfa97f44f6b68e3f3affaad4ad621707bad4b1e41366c0ebf9bbd703443