Skip to content
ATO Pathways
  Log In

Set configuration for loopback traffic

An XCCDF Rule

Description

Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.

warning alert: Warning

Changing firewall settings while connected over network can result in being locked out of the system.

Rationale

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

ID
xccdf_org.ssgproject.content_rule_set_loopback_traffic
Severity
Medium
References
Updated



Remediation - Shell Script

# Remediation is applicable only in certain platforms
if ( ! ( rpm --quiet -q nftables ) && ! ( rpm --quiet -q ufw ) && rpm --quiet -q iptables ); then

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -j DROP

Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-91345-9
  - PCI-DSS-Req-1.3