Set UFW Loopback Traffic
An XCCDF Rule
Description
Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.
warning alert: Warning
Changing firewall settings while connected over network can
result in being locked out of the system.
Rationale
Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
- ID
- xccdf_org.ssgproject.content_rule_set_ufw_loopback_traffic
- Severity
- Medium
- References
- Updated
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'ufw' 2>/dev/null | grep -q installed; }; then
ufw allow in on lo
ufw allow out on lo
ufw deny in from 127.0.0.0/8