SV-227071r603265: The system must employ a local firewall. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The system must employ a local firewall.

Description

Discussion Text

A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-26974V-22582

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Determine the zone that you are currently securing.

# zonename

If the command output is "global", only the "phys" and "SR-IOV" interfaces assigned to the global zone require inspection. If using a non-Global zone, all "phys" and "SR-IOV" interfaces assigned to the zone require inspection.

Determine if the system is using a local firewall.
# svcs network/ipfilter
If the service is not online, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Reconstructed from oval:mil.disa.fso.solaris11:def:426
# The system must employ a local firewall.
# This rule's OVAL object type(s) aren't yet recognized as a curated
# Linux/Unix or Windows mechanism -- see the MANUAL REVIEW notes below.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - ndd_object (ndd_test) -- NDD sees /dev/ip: no curated SCC reference for ndd_object
#   - ndd_object (ndd_test) -- NDD sees /dev/ip6: no curated SCC reference for ndd_object

# /dev/ip exists.
# file_object (file_test)
test_1() {
  test -e '/dev/ip' &>/dev/null
}
# /dev/ip6 exists.
# file_object (file_test)
test_2() {
  test -e '/dev/ip6' &>/dev/null
}
# ipfilter is online
# smf_object (smf_test)
test_5() {
  (svcs -H -o state 'svc://localhost/network/ipfilter:default') | grep -qxF 'ONLINE'
}

if ( test_1 || test_2 || test_5 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.solaris11:def:426
if [ -e /dev/ip ] || [ -e /dev/ip6 ]; then echo "PASS"; exit 0; fi
if [ ! -e /dev/ip ] && [ ! -e /dev/ip6 ]; then echo "FAIL"; exit 1; fi
if [ -x /usr/sbin/ipfilter ]; then echo "PASS"; exit 0; fi
if [ ! -x /usr/sbin/ipfilter ]; then echo "FAIL"; exit 1; fi
svcs | grep -q "network/ipfilter:default" && echo "PASS" || echo "FAIL"
exit 0

Remediation

Enable the system's local firewall.
# svcadm enable network/ipfilter