SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).

Information

A firewall that relies on a deny all, permit by exception strategy requires all traffic to have explicit permission before traversing an interface on the host. The firewall must incorporate stateful packet filtering and logging.

Nonlocal maintenance and diagnostic communications often contain sensitive information and must be protected. The security of these remote accesses can be ensured by sending nonlocal maintenance and diagnostic communications through encrypted channels enforced via firewall configurations.

Satisfies: SRG-OS-000074, SRG-OS-000096, SRG-OS-000112, SRG-OS-000113, SRG-OS-000125, SRG-OS-000250, SRG-OS-000393

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

The root role is required.

For Solaris 11, 11.1, 11.2, and 11.3, which use IP Filter, configure and enable the IP Filters policy.

# pfedit /etc/ipf/ipf.conf.

Add the following lines to the file:

# Do not allow all outbound traffic, keep state, and log
block out log all keep state keep frags
# Block and log everything else that comes in
block in log all
block in log from any to 255.255.255.255
block in log from any to 127.0.0.1/32

Enable ipfilter.

# svcadm enable ipfilter

Notify ipfilter to use the new configuration file.

# ipf -Fa -f /etc/ipf/ipf.conf

For Solaris 11.3 or newer, which use Packet Filter, configure and enable the Packet Filter's policy.
# pfedit /etc/firewall/pf.conf.

Add either of the following lines to the file:

# Block and log all traffic on all interfaces in either direction from anywhere to anywhere
block log all
-or-
# Drop traffic and log it to a fllog interface for more detailed inspection or analysis using tools like tcpdump
block drop log (to pflog0) all

Enable Packet Filter.
# svcadm enable firewall:default
Enable Packet Filter logging daemon.
# svcadm enable firewall/pflog:default

Note: Because the default firewall rules block all network access to the system, ensure there is still a method to access the system, such as SSH or console access, prior to activating the firewall rules. Operational requirements may dictate the addition of protocols such as SSH, DNS, NTP, HTTP, and HTTPS to be allowed.

Item Details

Audit Name: DISA Solaris 11 X86 STIG v3r3

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, MAINTENANCE

Plugin: Unix

Control ID: e2f6f50545b06098398e25332ec1d6531f4b5690ab35419c64747158048b5c31

Detections

Analytics

SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).

Information

Solution

See Also

Item Details