Verify ip6tables Enabled if Using IPv6

An XCCDF Rule

Description

The ip6tables service can be enabled with the following command:

$ sudo systemctl enable ip6tables.service

Rationale

The ip6tables service provides the system's host-based firewalling capability for IPv6 and ICMPv6.

ID: xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
Severity: Medium
References: 1 11 12 13 14 15 16 18 3 4 6 8 9

APO01.06 APO13.01 BAI10.01 BAI10.02 BAI10.03 BAI10.05 DSS01.05 DSS03.01 DSS05.02 DSS05.04 DSS05.05 DSS05.07 DSS06.02 DSS06.06

4.2.3.4 4.3.3.4 4.3.3.5.1 4.3.3.5.2 4.3.3.5.3 4.3.3.5.4 4.3.3.5.5 4.3.3.5.6 4.3.3.5.7 4.3.3.5.8 4.3.3.6.1 4.3.3.6.2 4.3.3.6.3 4.3.3.6.4 4.3.3.6.5 4.3.3.6.6 4.3.3.6.7 4.3.3.6.8 4.3.3.6.9 4.3.3.7.1 4.3.3.7.2 4.3.3.7.3 4.3.3.7.4 4.3.4.3.2 4.3.4.3.3 4.4.3.3

SR 1.1 SR 1.10 SR 1.11 SR 1.12 SR 1.13 SR 1.2 SR 1.3 SR 1.4 SR 1.5 SR 1.6 SR 1.7 SR 1.8 SR 1.9 SR 2.1 SR 2.2 SR 2.3 SR 2.4 SR 2.5 SR 2.6 SR 2.7 SR 3.1 SR 3.5 SR 3.8 SR 4.1 SR 4.3 SR 5.1 SR 5.2 SR 5.3 SR 7.1 SR 7.6

A.10.1.1 A.11.1.4 A.11.1.5 A.11.2.1 A.12.1.1 A.12.1.2 A.12.5.1 A.12.6.2 A.13.1.1 A.13.1.2 A.13.1.3 A.13.2.1 A.13.2.2 A.13.2.3 A.13.2.4 A.14.1.2 A.14.1.3 A.14.2.2 A.14.2.3 A.14.2.4 A.6.1.2 A.7.1.1 A.7.1.2 A.7.3.1 A.8.2.2 A.8.2.3 A.9.1.1 A.9.1.2 A.9.2.3 A.9.4.1 A.9.4.4 A.9.4.5

CIP-003-8 R4 CIP-003-8 R5 CIP-004-6 R3

AC-4 CA-3(5) CM-6(a) CM-7(b) SC-7(21)

DE.AE-1 ID.AM-3 PR.AC-5 PR.DS-5 PR.IP-1 PR.PT-3 PR.PT-4
Updated: about 1 month ago

Remediation Templates

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_ip6tables_enabled
- name: Verify ip6tables Enabled if Using IPv6 - Enable service ip6tables
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Verify ip6tables Enabled if Using IPv6 - Enable Service ip6tables
    ansible.builtin.systemd:
      name: ip6tables
      enabled: true
      state: started
      masked: false
    when:
    - '"iptables-ipv6" in ansible_facts.packages'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_ip6tables_enabled

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ip6tables.service'
"$SYSTEMCTL_EXEC" start 'ip6tables.service'"$SYSTEMCTL_EXEC" enable 'ip6tables.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

include enable_ip6tables
class enable_ip6tables {
  service {'ip6tables':
    enable => true,
    ensure => 'running',
  }
}

[customizations.services]
enabled = ["ip6tables"]

Verify ip6tables Enabled if Using IPv6

Description

Rationale

Remediation Templates

An Ansible Snippet

A Shell Script

A Puppet Snippet

OS Build Blueprint