Install nftables Package
An XCCDF Rule
Description
nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem. Thenftables
package can be installed with the following command:
$ sudo yum install nftables
Rationale
nftables
is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.
- ID
- xccdf_org.ssgproject.content_rule_package_nftables_installed
- Severity
- Medium
- Updated
Remediation Templates
Anaconda Pre-Install Instructions
package --add=nftables
OS Build Blueprint
[[packages]]
name = "nftables"
version = "*"
An Ansible Snippet
- name: Ensure nftables is installed
package:
name: nftables
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
A Puppet Snippet
include install_nftables
class install_nftables {
package { 'nftables':
ensure => 'installed',
}
}
A Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
if ! rpm -q --quiet "nftables" ; then
yum install -y "nftables"
fi