The Photon operating system must not send IPv4 Internet Control Message Protocol (ICMP) redirects.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256571	PHTN-30-000102	SV-256571r887387_rule		Medium

Description
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.

STIG	Date
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60246r887385_chk )
At the command line, run the following command: # /sbin/sysctl -a --pattern "net.ipv4.conf.(all\|default\|eth.*).send_redirects" Expected result: net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.eth0.send_redirects = 0 If the output does not match the expected result, this is a finding. Note: The number of "ethx" lines returned is dependent on the number of interfaces. Every "ethx" entry must be set to "0".

Check Text ( C-60246r887385_chk )

At the command line, run the following command:

# /sbin/sysctl -a --pattern "net.ipv4.conf.(all|default|eth.*).send_redirects"

Expected result:

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0

If the output does not match the expected result, this is a finding.

Note: The number of "ethx" lines returned is dependent on the number of interfaces. Every "ethx" entry must be set to "0".

Fix Text (F-60189r887386_fix)
At the command line, run the following command: # for SETTING in $(/sbin/sysctl -aN --pattern "net.ipv4.conf.(all\|default\|eth.*).send_redirects"); do sed -i -e "/^${SETTING}/d" /etc/sysctl.conf;echo $SETTING=0>>/etc/sysctl.conf; done # /sbin/sysctl --load