Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The system must not accept ICMPv4 secure redirect packets by default.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must not accept ICMPv4 secure redirect packets by default.

Description

Discussion Text

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-208858

Rule

SV-208858r793643_rule

Severity

medium

Rule Version

OL6-00-000090

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The status of the "net.ipv4.conf.default.secure_redirects"  kernel parameter can be queried by running the following command: 

$ sysctl net.ipv4.conf.default.secure_redirects

The output of the command should indicate a value of "0". If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in "/etc/sysctl.conf".

$ grep net.ipv4.conf.default.secure_redirects /etc/sysctl.conf

If the correct value is not returned, this is a finding.

Implementation Procedure

Fix Text

To set the runtime status of the "net.ipv4.conf.default.secure_redirects" kernel parameter, run the following command: 

# sysctl -w net.ipv4.conf.default.secure_redirects=0

If this is not the system's default value, add the following line to "/etc/sysctl.conf": 

net.ipv4.conf.default.secure_redirects = 0

STIG check 66 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-208857The system must not accept IPv4 source-routed packets by default.Next · V-208859 →The system must ignore ICMPv4 redirect messages by default.