Detections
Analytics
PHTN-30-000100 - The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
Information
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.Solution
At the command line, run the following command:# for SETTING in $(/sbin/sysctl -aN --pattern 'net.ipv4.conf.(all|default|eth.*).accept_redirects'); do sed -i -e '/^${SETTING}/d' /etc/sysctl.conf;echo $SETTING=0>>/etc/sysctl.conf; done
# /sbin/sysctl --load
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y25M01_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 7.0 Photon OS v1r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-256569r991589_rule, STIG-ID|PHTN-30-000100, Vuln-ID|V-256569
Plugin: Unix
Control ID: 4eb6841e04f2c66b3a605f133be57655b9daea42ba5b4ed4b5244550771e8e41