Check Details

• Resource: Server
• Check: Ensure source routed packets are not accepted
• Risk: Accepting source routed packets can allow attackers to bypass routing restrictions and access restricted networks.

Remediation Steps

1. Open a terminal session with root or sudo privileges.

2. Run the following commands to set the active kernel parameters:

   

   sysctl -w net.ipv4.conf.all.accept_source_route=0
   sysctl -w net.ipv4.conf.default.accept_source_route=0
   sysctl -w net.ipv6.conf.all.accept_source_route=0
   sysctl -w net.ipv6.conf.default.accept_source_route=0
   sysctl -w net.ipv4.route.flush=1
   sysctl -w net.ipv6.route.flush=1
   

3. These commands disable acceptance of source routed packets for both IPv4 and IPv6.
4. On systems where /etc is stateless (such as Container-Optimized OS), these changes are not persistent across reboots.
5. Ensure these commands are executed after every system reboot if persistence is not supported.

6. Verify the configuration by running audit commands:

   

   sysctl net.ipv4.conf.all.accept_source_route
   sysctl net.ipv4.conf.default.accept_source_route
   sysctl net.ipv6.conf.all.accept_source_route
   sysctl net.ipv6.conf.default.accept_source_route
   

7. Ensure all values return 0.
8. Perform regular audits to ensure compliance.