The Photon operating system must use a reverse-path filter for IPv4 network traffic.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239181	PHTN-67-000110	SV-239181r675351_rule		Medium

Description
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.

STIG	Date
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide	2021-04-15

Details

Check Text ( C-42392r675349_chk )
At the command line, execute the following command: # /sbin/sysctl -a --pattern "net.ipv4.conf.(all\|default\|eth.*)\.rp_filter" Expected result: net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 If the output does not match the expected result, this is a finding. Note: The number of "ethx" lines returned is dependent on the number of interfaces. Every "ethx" entry must be set to "1".

Check Text ( C-42392r675349_chk )

At the command line, execute the following command:

# /sbin/sysctl -a --pattern "net.ipv4.conf.(all|default|eth.*)\.rp_filter"

Expected result:

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1

If the output does not match the expected result, this is a finding.

Note: The number of "ethx" lines returned is dependent on the number of interfaces. Every "ethx" entry must be set to "1".

Fix Text (F-42351r675350_fix)
At the command line, execute the following command: # for SETTING in $(/sbin/sysctl -aN --pattern "net.ipv4.conf.(all\|default\|eth.*)\.rp_filter"); do sed -i -e "/^${SETTING}/d" /etc/sysctl.conf;echo $SETTING=1>>/etc/sysctl.conf; done