The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) secure redirect messages from being accepted.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) secure redirect messages from being accepted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258889	PHTN-40-000226	SV-258889r933728_rule		Medium

Description
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

STIG	Date
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62629r933726_chk )
At the command line, run the following command to verify ICMP secure redirects are not accepted: # /sbin/sysctl -a --pattern "net.ipv4.conf.(all\|default).secure_redirects" Expected result: net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 If the "secure_redirects" kernel parameters are not set to "0", this is a finding.

Fix Text (F-62538r933727_fix)
Navigate to and open: /etc/sysctl.d/zz-stig-hardening.conf Add or update the following lines: net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 At the command line, run the following command to load the new configuration: # /sbin/sysctl --load /etc/sysctl.d/zz-stig-hardening.conf Note: If the file zz-stig-hardening.conf does not exist, it must be created.