UCF STIG Viewer Logo

The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22491 GEN005610 SV-64245r1_rule Medium
Description
If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.
STIG Date
Oracle Linux 5 Security Technical Implementation Guide 2020-02-25

Details

Check Text ( C-52651r1_chk )
Check if the system is configured for IPv6 forwarding.

# grep [01] /proc/sys/net/ipv6/conf/*/forwarding|egrep "default|all"

If the /proc/sys/net/ipv6/conf/*/forwarding entries do not exist because of compliance with GEN007720, this is not a finding.

If all of the resulting lines do not end with 0, this is a finding.
Fix Text (F-54803r1_fix)
Disable IPv6 forwarding.

Edit /etc/sysctl.conf and add a setting for "net.ipv6.conf.all.forwarding=0" and "net.ipv6.conf.default.forwarding=0".

Reload the sysctls.
Procedure:
# sysctl -p