← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22411

CAT II (Medium)

The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address.

Rule ID

SV-45723r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-001551

Discussion

The processing of (ICMP) timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.

Check Content

Verify the system does not respond to ICMP TIMESTAMP_REQUESTs set to broadcast addresses.

Procedure:
# cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

If the result is not 1, this is a finding.

Note: The same parameter controls both ICMP ECHO_REQUESTs and TIMESTAMP_REQUESTs.

Fix Text

Configure the system to not respond to ICMP TIMESTAMP_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for "net.ipv4.icmp_echo_ignore_broadcasts=1" and reload the sysctls.

Procedure:
# echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
# sysctl -p