← Back to Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

V-269248

CAT II (Medium)

AlmaLinux OS 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Rule ID

SV-269248r1050130_rule

STIG

Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

Version

V1R6

CCIs

CCI-000366

Discussion

Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

Check Content

Verify AlmaLinux OS 9 does not respond to ICMP echoes sent to a broadcast address with the following command:

$ sysctl net.ipv4.icmp_echo_ignore_broadcasts

net.ipv4.icmp_echo_ignore_broadcasts = 1

If the returned line does not have a value of "1", this is a finding.

Fix Text

Configure AlmaLinux OS 9 to use reverse path filtering on all IP interfaces.

Create a numbered *.conf file in /etc/sysctl.d/ with the following content:

net.ipv4.icmp_echo_ignore_broadcasts = 1

The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following command:

$ sysctl –system