Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

The Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide (V1 R2) has 391 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

391STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Sep 30 2026

TOSS 5 must use reverse path filtering on all IPv4 interfaces.

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Assessment Title

Rule Text

TOSS 5 must use reverse path filtering on all IPv4 interfaces.

Description

Discussion Text

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface on which they were received. It must not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-282689

Rule

SV-282689r1201344_rule

Severity

medium

Rule Version

TOSS-05-000217

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify TOSS 5 uses reverse path filtering on all IPv4 interfaces using the following command:

$ sudo sysctl net.ipv4.conf.all.rp_filter

net.ipv4.conf.all.rp_filter = 1

If the returned line does not have a value of "1", or a line is not returned, this is a finding.

Implementation Procedure

Fix Text

Configure TOSS 5 to use reverse path filtering on all IPv4 interfaces. 

Add or edit the following line in a single system configuration file, in the "/etc/sysctl.d/" directory:

net.ipv4.conf.all.rp_filter = 1

Reload the system configuration files for the changes to take effect.

$ sudo sysctl --system

STIG check 315 of 391 in the Tri-Lab Operating System Stack (TOSS) 5 STIG checklist

← Previous · V-282688TOSS 5 must log IPv4 packets with impossible addresses by default.Next · V-282690 →TOSS 5 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.