The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258888	PHTN-40-000225	SV-258888r933725_rule		Medium

Description
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

STIG	Date
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62628r933723_chk )
At the command line, run the following command to verify ICMP redirects are not accepted: # /sbin/sysctl -a --pattern "net.ipv4.conf.(all\|default).accept_redirects" Expected result: net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 If the "accept_redirects" kernel parameters are not set to "0", this is a finding.

Fix Text (F-62537r933724_fix)
Navigate to and open: /etc/sysctl.d/zz-stig-hardening.conf Add or update the following lines: net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 At the command line, run the following command to load the new configuration: # /sbin/sysctl --load /etc/sysctl.d/zz-stig-hardening.conf Note: If the file zz-stig-hardening.conf does not exist, it must be created.