Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Anolis OS 23

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_ra</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...
    Rule Medium Severity
    Show

  • Limit Network-Transmitted Configuration if Using Static IPv6 Addresses

    To limit the configuration information requested from other systems and accepted from the network on a system that uses statically-configured IPv6 ...
    Group
    Show

  • Kernel Parameters Which Affect Networking

    The <code>sysctl</code> utility is used to set parameters which affect the operation of the Linux kernel. Kernel parameters which affect networking...
    Group
    Show

  • Network Related Kernel Runtime Parameters for Hosts and Routers

    Certain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against cert...
    Group
    Show

  • net.ipv4.conf.all.accept_redirects

    Disable ICMP Redirect Acceptance
    Value
    Show

  • net.ipv4.conf.all.accept_source_route

    Trackers could be using source-routed packets to generate traffic that seems to be intra-net, but actually was created outside and has been redirec...
    Value
    Show

  • net.ipv4.conf.default.arp_filter

    Controls whether the ARP filter is enabled or not. 1 - Allows you to have multiple network interfaces on the same subnet, and have the ARPs for ea...
    Value
    Show

  • net.ipv4.conf.default.arp_ignore

    Control the response modes for ARP queries that resolve local target IP addresses: 0 - (default): reply for any local target IP address, configure...
    Value
    Show

  • net.ipv4.conf.all.forwarding

    Toggle IPv4 Forwarding
    Value
    Show

  • net.ipv4.conf.all.log_martians

    Disable so you don't Log Spoofed Packets, Source Routed Packets, Redirect Packets
    Value
    Show

  • net.ipv4.conf.all.rp_filter

    Enable to enforce sanity checking, also called ingress filtering or egress filtering. The point is to drop a packet if the source and destination I...
    Value
    Show

  • net.ipv4.conf.all.secure_redirects

    Enable to prevent hijacking of routing path by only allowing redirects from gateways known in routing table. Disable to refuse acceptance of secure...
    Value
    Show

  • net.ipv4.conf.all.shared_media

    Controls whether the system can send (router) or accept (host) RFC1620 shared media redirects. <code>shared_media</code> for the interface will be ...
    Value
    Show

  • net.ipv4.conf.default.accept_redirects

    Disable ICMP Redirect Acceptance?
    Value
    Show

  • net.ipv4.conf.default.accept_source_route

    Disable IP source routing?
    Value
    Show

  • net.ipv4.conf.default.log_martians

    Disable so you don't Log Spoofed Packets, Source Routed Packets, Redirect Packets
    Value
    Show

  • net.ipv4.conf.default.secure_redirects

    Enable to prevent hijacking of routing path by only allowing redirects from gateways known in routing table. Disable to refuse acceptance of secure...
    Value
    Show

  • net.ipv4.conf.default.shared_media

    Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects. <code>shared_media</code> for the interface will be en...
    Value
    Show

  • net.ipv4.icmp_echo_ignore_broadcasts

    Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
    Value
    Show

  • net.ipv4.icmp_ignore_bogus_error_responses

    Enable to prevent unnecessary logging
    Value
    Show

  • net.ipv4.tcp_invalid_ratelimit

    Configure the maximal rate for sending duplicate acknowledgments in response to incoming invalid TCP packets.
    Value
    Show

  • net.ipv4.tcp_rfc1337

    Enable to enable TCP behavior conformant with RFC 1337
    Value
    Show

  • net.ipv4.tcp_syncookies

    Enable to turn on TCP SYN Cookie Protection
    Value
    Show

  • Disable Accepting Packets Routed Between Local Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.accept_local</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...
    Rule Medium Severity
    Show

  • Disable Accepting ICMP Redirects for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...
    Rule Medium Severity
    Show

  • Configure ARP filtering for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.arp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.i...
    Rule Medium Severity
    Show

  • Configure Response Mode of ARP Requests for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.arp_ignore</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.i...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...
    Rule Unknown Severity
    Show

  • Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.route_localnet</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w n...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ip...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.shared_media</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...
    Rule Medium Severity
    Show

  • Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...
    Rule Medium Severity
    Show

  • Configure Kernel Parameter for Accepting Secure Redirects By Default

    To set the runtime status of the <code>net.ipv4.conf.default.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Configure Sending and Accepting Shared Media Redirects by Default

    To set the runtime status of the <code>net.ipv4.conf.default.shared_media</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.icmp_echo_ignore_broadcasts</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.icmp_ignore_bogus_error_responses</code> kernel parameter, run the following command: <pre>$ sudo s...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

    To set the runtime status of the <code>net.ipv4.tcp_syncookies</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.t...
    Rule Medium Severity
    Show

  • Network Parameters for Hosts Only

    If the system is not going to be used as a router, then setting certain kernel parameters ensure that the host will not perform routing of network ...
    Group
    Show

  • Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w n...
    Rule Medium Severity
    Show

  • cobbler_use_cifs SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.ip_forward</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.ip_fo...
    Rule Medium Severity
    Show

  • nftables

    <code>If firewalld or iptables are being used in your environment, please follow the guidance in their respective section and pass-over the guidanc...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules