Detections
Analytics
GEN005610 - The system must not have IP forwarding for IPv6 enabled unless the system is an IPv6 router - 'net.ipv6.conf.all.forwarding'
Information
If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.Solution
Disable IPv6 forwarding.Edit /etc/sysctl.conf and add a setting for 'net.ipv6.conf.all.forwarding=0' and 'net.ipv6.conf.default.forwarding=0'.
Reload the sysctls.
Procedure:
# sysctl -p
See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-22491, Rule-ID|SV-37930r2_rule, STIG-ID|GEN005610, Vuln-ID|V-22491
Plugin: Unix
Control ID: ec50bfb311efde7bc76c2e3eb46b06c4adfdfac8c7e969a2530ad19dcef14b0c