I am looking through the CIS recommendations for debian 8.
In a CIS compliance test using nessus, I see that the test for disabling ip forwarding has failed. But when I look at the system, I can see that it is in fact disabled.
$ cat /proc/net/ipv4/ip_forward 0
It seems like the CIS recommendation is to explicitly disable ip forwarding. But as far as I can tell, if you do not enable ip_forwarding explicitly, it will remain disabled.
Is there a bigger reason to do what the recommendation says, other than to make sure the default parameter is set?
For reference, I added the chapter for ip_forwarding below:
7.1.1 Disable IP Forwarding (Scored)
Description: The net.ipv4.ip_forward flag is used to tell the server whether it can forward packets or not. If the server is not to be used as a router, set the flag to 0.
Rationale: Setting the flag to 0 ensures that a server with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.
Perform the following to determine if net.ipv4.ip_forward is enabled on the system.
# /sbin/sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
Set the net.ipv4.ip_forward parameter to 0 in /etc/sysctl.conf:
Modify active kernel parameters to match:
# /sbin/sysctl -w net.ipv4.ip_forward=0
# /sbin/sysctl -w net.ipv4.route.flush=1