← Back to Oracle Linux 9 Security Technical Implementation Guide

V-271873

CAT II (Medium)

OL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Rule ID

SV-271873r1092331_rule

STIG

Oracle Linux 9 Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-000366

Discussion

Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

Check Content

Verify that OL 9 does not respond to ICMP echoes sent to a broadcast address.

Check the value of the "icmp_echo_ignore_broadcasts" variable with the following command:

$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1

If the returned line does not have a value of "1", a line is not returned, or the retuned line is commented out, this is a finding.

Fix Text

Configure OL 9 to not respond to IPv4 ICMP echoes sent to a broadcast address.

Add or edit the following line in a single system configuration file in the "/etc/sysctl.d/" directory:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Load settings from all system configuration files with the following command:

$ sudo sysctl --system