SV-235017r991589: The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default. | SUSE Linux Enterprise Server 15 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.

Description

Discussion Text

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target SUSE Linux Enterprise Server 15 DISA DPMS Target SUSE Linux Enterprise Server 15 5274

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.sles15:def:227
# The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# sysctl_object (sysctl_test)
test_1() {
  [ "$(cat /proc/sys/net/ipv6/conf/default/accept_source_route)" -eq 0 ]
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure the SUSE operating system to disable IPv6 default source routing by running the following command as an administrator:

> sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

If "0" is not the system's default value, add or update the following line in "/etc/sysctl.d/99-stig.conf":

> sudo sh -c 'echo "net.ipv6.conf.default.accept_source_route=0" >> /etc/sysctl.d/99-stig.conf'

> sudo sysctl --system