<Group id="network-kernel">
<title>Kernel Parameters Which Affect Networking</title>
<description>The <tt>sysctl</tt> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.
</description>

<Group id="network_host_parameters">
<title>Network Parameters for Hosts Only</title>
<description>If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</description>

<Rule id="sysctl_net_ipv4_conf_default_send_redirects" severity="medium">
<title>Disable Kernel Parameter for Sending ICMP Redirects by Default</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.default.send_redirects" value="0" />
</ocil>
<rationale>Sending ICMP redirects permits the system to instruct other systems
to update their routing information.  The ability to send ICMP redirects is
only appropriate for systems acting as routers.</rationale>
<ident cce="27001-7"  stig="RHEL-06-000080" />
<oval id="sysctl_net_ipv4_conf_default_send_redirects" />
<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_all_send_redirects" severity="medium">
<title>Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
</ocil>
<rationale>Sending ICMP redirects permits the system to instruct other systems
to update their routing information.  The ability to send ICMP redirects is
only appropriate for systems acting as routers.</rationale>
<ident cce="27004-1"  stig="RHEL-06-000081" />
<oval id="sysctl_net_ipv4_conf_all_send_redirects" />
<ref nist="CM-7,SC-5(1)" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_ipv4_ip_forward" severity="medium">
<title>Disable Kernel Parameter for IP Forwarding</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
The ability to forward packets is only appropriate for routers.
</ocil>
<rationale>IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers.</rationale>
<ident cce="26866-4"  stig="RHEL-06-000082" />
<oval id="sysctl_net_ipv4_ip_forward" />
<ref nist="CM-7, SC-5" disa="366"/>
<tested by="DS" on="20121024"/>
</Rule>
</Group>

<Group id="network_host_and_router_parameters">
<title>Network Related Kernel Runtime Parameters for Hosts and Routers</title>
<description>Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</description>

<Value id="sysctl_net_ipv4_conf_all_accept_source_route_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.accept_source_route</title>
<description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_accept_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.accept_redirects</title>
<description>Disable ICMP Redirect Acceptance</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_secure_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.secure_redirects</title>
<description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table.</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_log_martians_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.log_martians</title>
<description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_accept_source_route_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.accept_source_route</title>
<description>Disable IP source routing?</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_accept_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.accept_redirects</title>
<description>Disable ICMP Redirect Acceptance?</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_secure_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.secure_redirects</title>
<description>Log packets with impossible addresses to kernel
log?</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.icmp_echo_ignore_broadcasts</title>
<description>Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.icmp_ignore_bogus_error_responses</title>
<description>Enable to prevent unnecessary logging</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_tcp_syncookies_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.tcp_syncookies</title>
<description>Enable to turn on TCP SYN Cookie
Protection</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_all_rp_filter_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.rp_filter</title>
<description>Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_rp_filter_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.rp_filter</title>
<description>Enables source route verification</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Rule id="sysctl_net_ipv4_conf_all_accept_source_route" severity="medium">
<title>Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
</ocil>
<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="27037-1"  stig="RHEL-06-000083" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="CM-7,SC-5" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_all_accept_redirects" severity="medium">
<title>Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
</ocil>
<rationale>Accepting ICMP redirects has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="27027-2"  stig="RHEL-06-000084" />
<oval id="sysctl_net_ipv4_conf_all_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
<ref nist="CM-7,SC-5" disa="1503,1551"/>
<tested by="DS" on="20121024"/>
</Rule>


<Rule id="sysctl_net_ipv4_conf_all_secure_redirects" severity="medium">
<title>Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.secure_redirects" value="0" />
</ocil>
<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
<ident cce="26854-0"  stig="RHEL-06-000086" />
<oval id="sysctl_net_ipv4_conf_all_secure_redirects" value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
<ref nist="AC-4,CM-7,SC-5" disa="1503,1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_all_log_martians">
<title>Enable Kernel Parameter to Log Martian Packets</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
</ocil>
<rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
<ident cce="27066-0"  stig="RHEL-06-000088" />
<oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
<ref nist="AC-3(10),CM-7,SC-5(3)" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>


<Rule id="sysctl_net_ipv4_conf_default_accept_source_route" severity="medium">
<title>Disable Kernel Parameter for Accepting Source-Routed Packets By Default</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_source_route" value="0" />
</ocil>
<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="26983-7"  stig="RHEL-06-000089" />
<oval id="sysctl_net_ipv4_conf_default_accept_source_route" value="sysctl_net_ipv4_conf_default_accept_source_route_value" />
<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_default_accept_redirects">
<title>Disable Kernel Parameter for Accepting ICMP Redirects By Default</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.default.accept_redirects" value="0" />
</ocil>
<rationale>This feature of the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="27015-7"  stig="RHEL-06-000091" />
<oval id="sysctl_net_ipv4_conf_default_accept_redirects" />
<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_default_secure_redirects" severity="medium">
<title>Disable Kernel Parameter for Accepting Secure Redirects By Default</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.default.secure_redirects" value="0" />
</ocil>
<rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
<ident cce="26831-8"  stig="RHEL-06-000090" />
<oval id="sysctl_net_ipv4_conf_default_secure_redirects" value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
<ref nist="AC-4,CM-7,SC-5,SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts">
<title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
</ocil>
<rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.
</rationale>
<ident cce="26883-9"  stig="RHEL-06-000092" />
<oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
<ref nist="CM-7,SC-5" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses" value="1" />
</ocil>
<rationale>Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</rationale>
<ident cce="26993-6"  stig="RHEL-06-000093" />
<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
<ref nist="CM-7,SC-5" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_tcp_syncookies" severity="medium">
<title>Enable Kernel Parameter to Use TCP Syncookies</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
</ocil>
<rationale> A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.
</rationale>
<ident cce="27053-8"  stig="RHEL-06-000095" />
<oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
<ref nist="AC-4,SC-5(2),SC-5(3)" disa="1092, 1095" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_all_rp_filter" severity="medium">
<title>Enable Kernel Parameter to Use Reverse Path Filtering for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.rp_filter" value="1" />
</ocil>
<rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
<ident cce="26979-5"  stig="RHEL-06-000096" />
<oval id="sysctl_net_ipv4_conf_all_rp_filter" value="sysctl_net_ipv4_conf_all_rp_filter_value" />
<ref nist="AC-4,SC-5,SC-7" disa="1551"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="sysctl_net_ipv4_conf_default_rp_filter" severity="medium">
<title>Enable Kernel Parameter to Use Reverse Path Filtering by Default</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />
</ocil>
<rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
<ident cce="26915-9"  stig="RHEL-06-000097" />
<oval id="sysctl_net_ipv4_conf_default_rp_filter" value="sysctl_net_ipv4_conf_default_rp_filter_value" />
<ref nist="AC-4,SC-5,SC-7" />
<tested by="DS" on="20121024"/>
</Rule>

</Group>
</Group>
