Check Details

• Resource: Server
• Check: Ensure ICMP redirects are not accepted
• Risk: Attackers can manipulate routing tables using ICMP redirects, potentially leading to traffic interception or data leakage.

Remediation Steps

1. Open a terminal session with root or sudo privileges.

2. Verify current ICMP redirect settings:

   

   sysctl net.ipv4.conf.all.accept_redirects
   sysctl net.ipv4.conf.default.accept_redirects
   sysctl net.ipv6.conf.all.accept_redirects
   sysctl net.ipv6.conf.default.accept_redirects
   

3. Ensure all values are set to 0.

4. Set the active kernel parameters:

   

   sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
   sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
   sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
   sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
   

5. Flush routing table to apply changes:

   

   sudo sysctl -w net.ipv4.route.flush=1
   sudo sysctl -w net.ipv6.route.flush=1
   

6. Make the configuration persistent:

   

   sudo nano /etc/sysctl.conf
   

7. Add or update the following lines:

   

   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   net.ipv6.conf.all.accept_redirects = 0
   net.ipv6.conf.default.accept_redirects = 0
   

8. Apply the changes:

   

   sudo sysctl -p
   

9. Re-run the audit commands to confirm the settings.