AlmaLinux OS 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
An XCCDF Rule
Description
Some routers will send responses to broadcast frames that violate RFC-1122, which fills up a log file system with many useless error messages. An attacker may take advantage of this and attempt to flood the logs with bogus error logs. Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.
- ID
- SV-269247r1050129_rule
- Version
- ALMA-09-018940
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure AlmaLinux OS 9 to use reverse path filtering on all IP interfaces.
Create a numbered *.conf file in /etc/sysctl.d/ with the following content:
net.ipv4.icmp_ignore_bogus_error_responses = 1