The Photon operating system must use a reverse-path filter for IPv4 network traffic.

An XCCDF Rule

Description

<VulnDiscussion>Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-258892r991589_rule
Severity: Medium
References: CCI-000366
Updated: 17 days ago

Navigate to and open:

/etc/sysctl.d/zz-stig-hardening.conf

Add or update the following lines:
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

At the command line, run the following command to load the new configuration:

# /sbin/sysctl --load /etc/sysctl.d/zz-stig-hardening.conf

Note: If the file zz-stig-hardening.conf does not exist, it must be created.

The Photon operating system must use a reverse-path filter for IPv4 network traffic.

Description

Remediation - Manual Procedure