Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-230537 | RHEL-08-040230 | SV-230537r627750_rule | Medium |
Description |
---|
Responding to broadcast ICMP echoes facilitates network mapping and provides a vector for amplification attacks. There are notable differences between Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6). IPv6 does not implement the same method of broadcast as IPv4. Instead, IPv6 uses multicast addressing to the all-hosts multicast group. Refer to RFC4294 for an explanation of "IPv6 Node Requirements", which resulted in this difference between IPv4 and IPv6. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 8 Security Technical Implementation Guide | 2021-03-04 |
Check Text ( C-33206r568357_chk ) |
---|
Verify RHEL 8 does not respond to ICMP echoes sent to a broadcast address. Note: If either IPv4 or IPv6 is disabled on the system, this requirement only applies to the active internet protocol version. Check the value of the "icmp_echo_ignore_broadcasts" variable with the following command: $ sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts = 1 If the returned line does not have a value of "1", a line is not returned, or the retuned line is commented out, this is a finding. |
Fix Text (F-33181r568358_fix) |
---|
Configure RHEL 8 to not respond to IPv4 ICMP echoes sent to a broadcast address with the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 If "1" is not the system's default value then add or update the following line in the appropriate file under "/etc/sysctl.d": net.ipv4.icmp_echo_ignore_broadcasts=1 |