Install nftables Package
An XCCDF Rule
Description
nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The nftables package can be installed with the following command:
$ sudo zypper install nftables
Rationale
nftables is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.
- ID
- xccdf_org.ssgproject.content_rule_package_nftables_installed
- Severity
- Medium
- References
- Updated
Remediation - OS Build Blueprint
[[packages]]
name = "nftables"
version = "*"
Remediation - Ansible
- name: Ensure nftables is installed
package:
name: nftables
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
Remediation - Puppet
include install_nftables
class install_nftables {
package { 'nftables':
ensure => 'installed',
}
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
zypper install -y "nftables"
else