Install nftables Package
An XCCDF Rule
Description
nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The nftables package can be installed with the following command:
$ sudo zypper install nftables
Rationale
nftables is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.
- ID
- xccdf_org.ssgproject.content_rule_package_nftables_installed
- Severity
- Medium
- References
- Updated
Remediation - Puppet
include install_nftables
class install_nftables {
package { 'nftables':
ensure => 'installed',
}
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-92469-6
- PCI-DSSv4-1.2
Remediation - OS Build Blueprint
[[packages]]
name = "nftables"
version = "*"
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if ( rpm --quiet -q kernel-default ); then
zypper install -y "nftables"
else