Skybox Appliance 8000 Quick Start Guide
Skybox version 10.1.200
62
Recommend
ation
Scored Description
corrupt routing and have users access a system set up by the
attacker as opposed to a valid system.
3.2.1 – 3.2.3
3.2.1: Ensure that source routed packets are not accepted.
Rationale: Setting
net.ipv4.conf.all.accept_source_route
and
net.ipv4.conf.default.accept_source_route
to 0
disables the system from accepting source routed packets.
Assume that the system is capable of routing packets to
Internet routable addresses on one interface and private
addresses on another interface, and the private addresses are
not routable to the Internet routable addresses and vice
versa. Under normal routing circumstances, an attacker from
the Internet routable addresses cannot use the system as a
way to reach the private address systems. If, however, source
routed packets are permitted, they can be used to gain access
to the private address systems as the route can be specified,
rather than relying on routing protocols that do not permit this
routing.
3.2.2: Ensure that ICMP redirects are not accepted.
Rationale: Attackers could use bogus ICMP redirect messages
to maliciously alter the system routing tables and get them to
send packets to incorrect networks and permit your system
packets to be captured.
3.2.3: Ensure that secure ICMP redirects are not accepted.
Rationale: It is possible for even known gateways to be
compromised. Setting
net.ipv4.conf.all.secure_redirects
to
0
protects the
system from routing table updates by possibly compromised
known gateways.
3.2.4
Ensure that suspicious packets are logged. When enabled, this
feature logs packets with un-routable source addresses to the
kernel log.
Rationale: Enabling this feature and logging these packets
enables administrators to investigate the possibility that an
attacker is sending spoofed packets to their system.
3.5.1 – 3.5.4
Ensure that DCCP, SCTP, RDS, and TIPC are disabled.
Rationale: If these protocols are not being used, it is
recommended that the kernel modules not be loaded,
disabling the services to reduce the potential attack surface.
4.1.8 -4.1.9
Ensure that login and logout events are collected; Ensure that
session initiation information is collected. The file
/var/log/lastlog
maintain records of the last time a user
successfully logged in. The
/var/run/failock
directory
maintains records of login failures via the
pam_faillock
module. The file
/var/run/utmp
file tracks all currently logged
in users. The
/var/log/wtmp
file tracks logins, logouts,
shutdown, and reboot events. All audit records are tagged
with the identifier ‘session’. The file
/var/log/btmp
keeps
track of failed login attempts and can be read by entering the
command
/usr/bin/last -f /var/log/btmp
. All audit
records are tagged with the identifier ‘logins’.
Rationale: Monitoring login and logout events could provide a
