Solaris 11 SPARC STIG

Solaris 11 SPARC Security Technical Implementation Guide

The Solaris 11 SPARC Security Technical Implementation Guide (V3 R7) has 215 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

215STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R7

CurrentPublished Wed Sep 30 2026

The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).

Solaris 11 SPARC Security Technical Implementation Guide

Assessment Title

Rule Text

The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).

Description

Discussion Text

A firewall that relies on a deny all, permit by exception strategy requires all traffic to have explicit permission before traversing an interface on the host. The firewall must incorporate stateful packet filtering and logging.

Nonlocal maintenance and diagnostic communications often contain sensitive information and must be protected. The security of these remote accesses can be ensured by sending nonlocal maintenance and diagnostic communications through encrypted channels enforced via firewall configurations.

Satisfies: SRG-OS-000074, SRG-OS-000096, SRG-OS-000112, SRG-OS-000113, SRG-OS-000125, SRG-OS-000250, SRG-OS-000393

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-216387

Rule

SV-216387r1045450_rule

Severity

medium

Rule Version

SOL-11.1-050240

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Ensure that either the IP Filter or Packet Filter Firewall is installed correctly.

Determine the OS version to be secured.
# uname -v

For Solaris 11, 11.1, 11.2, and 11.3, that use IP Filter, the IP Filter Management profile is required.

Check that the IP Filter firewall is enabled and configured so that only authorized sessions are allowed.

# svcs ipfilter

If ipfilter is not listed with a state of online, this is a finding.

The IP Filter Management profile is required.

Check that the filters are configured properly.

# ipfstat -io

If the output of this command does not include the following lines, this is a finding.

block out log all keep state keep frags
block in log all
block in log from any to 255.255.255.255/32
block in log from any to 127.0.0.1/32

Even if the lines above are included in the output, it is possible that other lines can contradict the firewall settings. Review the firewall rules and ensure that they conform to organizational and mission requirements. If the firewall rules are not configured to organizational standards, this is a finding.

For Solaris 11.3 or newer, that use Packet Filter, the Network Firewall Management rights profile is required.

Check that the Packet Filter firewall is enabled and configured so that only authorized sessions are allowed.
# svcs firewall:default

If firewall is not listed with a state of "online", this is a finding.

The Network Firewall Management rights profile is required.
Check that the filters are configured properly.
# pfctl -s rules

If the output of this command does not include a line to block and log all traffic as in the following line, this is a finding (does not have to be exactly like the example).

block drop log (to pflog0) all

Check that the Packet Filter firewall logging daemon is enabled.
svcs firewall/pflog:default

If pflog is not listed with a state of "online", this is a finding.

Implementation Procedure

Fix Text

The root role is required.

For Solaris 11, 11.1, 11.2, and 11.3, that use IP Filter, configure and enable the IP Filters policy.

# pfedit /etc/ipf/ipf.conf. 

Add the following lines to the file:

# Do not allow all outbound traffic, keep state, and log
block out log all keep state keep frags
# Block and log everything else that comes in
block in log all
block in log from any to 255.255.255.255
block in log from any to 127.0.0.1/32

Enable ipfilter.

# svcadm enable ipfilter

Notify ipfilter to use the new configuration file.

# ipf -Fa -f /etc/ipf/ipf.conf

For Solaris 11.3 or newer, that use Packet Filter, configure and enable the Packet Filter’s policy.
# pfedit /etc/firewall/pf.conf.

Add either of the following lines to the file:

# Block and log all traffic on all interfaces in either direction from anywhere to anywhere
block log all
     -or-
# Drop traffic and log it to a fllog interface for more detailed inspection or analysis using tools like tcpdump
block drop log (to pflog0) all

Enable Packet Filter.
# svcadm enable firewall:default
Enable Packet Filter logging daemon.
# svcadm enable firewall/pflog:default

Note: Because the default firewall rules block all network access to the system, ensure that there is still a method to access the system such as SSH or console access prior to activating the firewall rules. Operational requirements may dictate the addition of protocols such as SSH, DNS, NTP, HTTP, and HTTPS to be allowed.

STIG check 115 of 215 in the Solaris 11 SPARC STIG checklist

← Previous · V-216381The system must implement TCP Wrappers.Next · V-216394 →The system must prevent local applications from generating source-routed packets.