Rules with cis Reference in Guide to the Secure Configuration of Red Hat Enterprise Linux 6
Reference (cis) |
Rule Title |
Description |
Rationale |
Variable Setting |
4.1.1 |
Disable Kernel Parameter for IPv6 Forwarding |
To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter,
run the following command:
$ sudo sysctl -w net.ipv6.conf.all.forwarding=0
If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.all.forwarding = 0
|
IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
|
4.4.1.2 |
Configure Accepting IPv6 Redirects By Default |
To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter,
run the following command:
$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.all.accept_redirects = 0
|
An illicit ICMP redirect message could result in a man-in-the-middle attack. |
|
4.4.1.1 |
Configure Accepting IPv6 Router Advertisements |
To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter,
run the following command:
$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.default.accept_ra = 0
|
An illicit router advertisement message could result in a man-in-the-middle attack. |
|
4.4.1.1 |
Configure Accepting IPv6 Router Advertisements |
To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter,
run the following command:
$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.all.accept_ra = 0
|
An illicit router advertisement message could result in a man-in-the-middle attack. |
|
4.4.1.2 |
Configure Accepting IPv6 Redirects By Default |
To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter,
run the following command:
$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.default.accept_redirects = 0
|
An illicit ICMP redirect message could result in a man-in-the-middle attack. |
|