Set configuration for IPv6 loopback traffic

An XCCDF Rule

Description

Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.

warning alert: Warning

Changing firewall settings while connected over network can result in being locked out of the system.

Rationale

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

ID: xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic
Severity: Medium
References: Req-1.3

1.4.1

3.5.3.3.2

CCE-91346-7
Updated: about 1 year ago

# Remediation is applicable only in certain platforms
if ( ! ( rpm --quiet -q nftables ) && ! ( rpm --quiet -q ufw ) && rpm --quiet -q iptables ); then

if [ "$(sysctl -n net.ipv6.conf.all.disable_ipv6)" -eq 0 ]; then
  # IPv6 is not disabled, so run the script
  ip6tables -A INPUT -i lo -j ACCEPT  ip6tables -A OUTPUT -o lo -j ACCEPT
  ip6tables -A INPUT -s ::1 -j DROP
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-91346-7
  - PCI-DSS-Req-1.3  - PCI-DSSv4-1.4.1
  - medium_severity
  - set_ipv6_loopback_traffic

- name: Check if IPv6 is enabled
  command: sysctl -n net.ipv6.conf.all.disable_ipv6
  register: ipv6_status
  failed_when: ipv6_status.stdout != "0"
  when: ( not ( "nftables" in ansible_facts.packages ) and not ( "ufw" in ansible_facts.packages
    ) and "iptables" in ansible_facts.packages )
  tags:
  - CCE-91346-7
  - PCI-DSS-Req-1.3
  - PCI-DSSv4-1.4.1
  - medium_severity
  - set_ipv6_loopback_traffic

- name: Allow incoming traffic on the loopback interface
  ansible.builtin.iptables:
    ipv6: true
    chain: INPUT
    in_interface: lo
    jump: ACCEPT
  when:
  - ( not ( "nftables" in ansible_facts.packages ) and not ( "ufw" in ansible_facts.packages
    ) and "iptables" in ansible_facts.packages )
  - ipv6_status.stdout == '0'
  tags:
  - CCE-91346-7
  - PCI-DSS-Req-1.3
  - PCI-DSSv4-1.4.1
  - medium_severity
  - set_ipv6_loopback_traffic

- name: Allow outgoing traffic on the loopback interface
  ansible.builtin.iptables:
    ipv6: true
    chain: OUTPUT
    out_interface: lo
    jump: ACCEPT
  when:
  - ( not ( "nftables" in ansible_facts.packages ) and not ( "ufw" in ansible_facts.packages
    ) and "iptables" in ansible_facts.packages )
  - ipv6_status.stdout == '0'
  tags:
  - CCE-91346-7
  - PCI-DSS-Req-1.3
  - PCI-DSSv4-1.4.1
  - medium_severity
  - set_ipv6_loopback_traffic

- name: Drop incoming traffic from the localhost
  ansible.builtin.iptables:
    ipv6: true
    chain: INPUT
    source: ::1
    jump: DROP
  when:
  - ( not ( "nftables" in ansible_facts.packages ) and not ( "ufw" in ansible_facts.packages
    ) and "iptables" in ansible_facts.packages )
  - ipv6_status.stdout == '0'
  tags:
  - CCE-91346-7
  - PCI-DSS-Req-1.3
  - PCI-DSSv4-1.4.1
  - medium_severity
  - set_ipv6_loopback_traffic

Set configuration for IPv6 loopback traffic

Description

Rationale

Remediation - Shell Script

Remediation - Ansible