UCF STIG Viewer Logo

The Ubuntu operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-215148 UBTU-16-030550 SV-215148r610931_rule Medium
Description
Responding to broadcast Internet Control Message Protocol (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
STIG Date
Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide 2020-12-09

Details

Check Text ( C-16347r285312_chk )
Verify the Ubuntu operating system does not respond to IPv4 Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Check the value of the "icmp_echo_ignore_broadcasts" variable with the following command:

# sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts
net.ipv4.icmp_echo_ignore_broadcasts=1

If the returned line does not have a value of "1", a line is not returned, or the retuned line is commented out, this is a finding.
Fix Text (F-16345r285313_fix)
Configure the Ubuntu operating system to not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address with the following command:

# sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

If "1" is not the system's default value then add or update the following line in "/etc/sysctl.conf" or in the appropriate file under "/etc/sysctl.d":

net.ipv4.icmp_echo_ignore_broadcasts=1