Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The system must not respond to ICMPv4 sent to a broadcast address.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must not respond to ICMPv4 sent to a broadcast address.

Description

Discussion Text

Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-208860

Rule

SV-208860r793645_rule

Severity

low

Rule Version

OL6-00-000092

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The status of the "net.ipv4.icmp_echo_ignore_broadcasts" kernel parameter can be queried by running the following command:

$ sysctl net.ipv4.icmp_echo_ignore_broadcasts

The output of the command should indicate a value of "1". If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in "/etc/sysctl.conf".

$ grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf

If the correct value is not returned, this is a finding.

Implementation Procedure

Fix Text

To set the runtime status of the "net.ipv4.icmp_echo_ignore_broadcasts" kernel parameter, run the following command: 

# sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

If this is not the system's default value, add the following line to "/etc/sysctl.conf": 

net.ipv4.icmp_echo_ignore_broadcasts = 1

STIG check 68 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-208859The system must ignore ICMPv4 redirect messages by default.Next · V-208861 →The system must ignore ICMPv4 bogus error responses.