Chapter 17
CIS benchmarks for CentOS 7
Skybox version 11.7.100
65
RECOMMENDATION
SCORED
DESCRIPTION
attempting to target specific exploits of a system.
Authorized users can get this information by running
uname -a
after they log in.
3.1.2
ü
Ensure that packet redirect sending is disabled.
Rationale: An attacker could use a compromised host to
send invalid ICMP redirects to other router devices in an
attempt to corrupt routing and have users access a system
set up by the attacker as opposed to a valid system.
3.2.1 – 3.2.3
ü
3.2.1: Ensure that source routed packets are not accepted.
Rationale: Setting
net.ipv4.conf.all.accept_
source_route
and
net.ipv4.conf.default.accept_source_route
to
0 disables the system from accepting source routed
packets. Assume that the system is capable of routing
packets to Internet routable addresses on one interface
and private addresses on another interface, and the
private addresses are not routable to the Internet routable
addresses and vice versa. Under normal routing
circumstances, an attacker from the Internet routable
addresses cannot use the system as a way to reach the
private address systems. If, however, source routed
packets are permitted, they can be used to gain access to
the private address systems as the route can be specified,
rather than relying on routing protocols that do not permit
this routing.
3.2.2: Ensure that ICMP redirects are not accepted.
Rationale: Attackers could use bogus ICMP redirect
messages to maliciously alter the system routing tables
and get them to send packets to incorrect networks and
permit your system packets to be captured.
3.2.3: Ensure that secure ICMP redirects are not accepted.
Rationale: Even known gateways can be compromised.
Setting
net.ipv4.conf.all.secure_redirects
to
0
protects the system from routing table updates by possibly
compromised known gateways.
3.2.4
ü
Ensure that suspicious packets are logged. When enabled,
this feature logs packets with un-routable source
addresses to the kernel log.
Rationale: Enabling this feature and logging these packets
enables administrators to investigate the possibility that an
attacker is sending spoofed packets to their system.
3.5.1 – 3.5.4
û
Ensure that DCCP, SCTP, RDS, and TIPC are disabled.
Rationale: If these protocols are not being used, it is
recommended that the kernel modules not be loaded,
disabling the services to reduce the potential attack
surface.
4.1.8 -4.1.9
ü
Ensure that login and logout events are collected; Ensure
that session initiation information is collected. The file
