Skip to content
ATO Pathways
  Log In

Verify nftables Service is Disabled

An XCCDF Rule

Description

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The nftables service can be disabled with the following command: 

systemctl disable nftables

Rationale

Running both firewalld and nftables may lead to conflict. nftables is actually one of the backends for firewalld management tools.

ID
xccdf_org.ssgproject.content_rule_service_nftables_disabled
Severity
Medium
References
Updated



Remediation - OS Build Blueprint


[customizations.services]
disabled = ["nftables"]

Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2.1
  - disable_strategy

Remediation - Puppet

include disable_nftables

class disable_nftables {
  service {'nftables':
    enable => false,
    ensure => 'stopped',

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && dpkg-query --show --showformat='${db:Status-Status}\n' 'firewalld' 2>/dev/null | grep -q installed && dpkg-query --show --showformat='${db:Status-Status}\n' 'nftables' 2>/dev/null | grep -q installed ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nftables.service'
"$SYSTEMCTL_EXEC" disable 'nftables.service'

Remediation - Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0