UCF STIG Viewer Logo

The Ubuntu operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.


Overview

Finding ID Version Rule ID IA Controls Severity
V-75875 UBTU-16-030540 SV-90555r3_rule Medium
Description
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.
STIG Date
Canonical Ubuntu 16.04 Security Technical Implementation Guide 2020-05-29

Details

Check Text ( C-75563r3_chk )
Verify the Ubuntu operating system does not accept Internet Protocol version 4 (IPv4) source-routed packets by default.

Check the value of the accept source route variable with the following command:

# sudo sysctl net.ipv4.conf.default.accept_source_route
net.ipv4.conf.default.accept_source_route=0

If the returned line does not have a value of "0", a line is not returned, or the returned line is commented out, this is a finding.
Fix Text (F-82505r3_fix)
Configure the Ubuntu operating system to not forward Internet Protocol version 4 (IPv4) source-routed packets by default with the following command:

# sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

If "0" is not the system's default value then add or update the following line in "/etc/sysctl.conf" or in the appropriate file under "/etc/sysctl.d":

net.ipv4.conf.default.accept_source_route=0