2

I am looking through the CIS recommendations for debian 8.

In a CIS compliance test using nessus, I see that the test for disabling ip forwarding has failed. But when I look at the system, I can see that it is in fact disabled.

$ cat /proc/net/ipv4/ip_forward
0

It seems like the CIS recommendation is to explicitly disable ip forwarding. But as far as I can tell, if you do not enable ip_forwarding explicitly, it will remain disabled.

Is there a bigger reason to do what the recommendation says, other than to make sure the default parameter is set?

For reference, I added the chapter for ip_forwarding below:

7.1.1 Disable IP Forwarding (Scored)

Profile Applicability:

Level 1

Description: The net.ipv4.ip_forward flag is used to tell the server whether it can forward packets or not. If the server is not to be used as a router, set the flag to 0.

Rationale: Setting the flag to 0 ensures that a server with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.

Audit:

Perform the following to determine if net.ipv4.ip_forward is enabled on the system.

# /sbin/sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 0

Remediation:

Set the net.ipv4.ip_forward parameter to 0 in /etc/sysctl.conf:

net.ipv4.ip_forward=0

Modify active kernel parameters to match:

# /sbin/sysctl -w net.ipv4.ip_forward=0

# /sbin/sysctl -w net.ipv4.route.flush=1

Improve this question
4
  • Looks like a false positive to me. I would ignore it. You could contact Nessus support to ask them to tweak the plugin.
    – paj28
    Oct 3, 2016 at 12:06
  • Looks like the whole chapter 7 is false positives. The default values in debian 8 are in compliance with CIS
    – Dog eat cat world
    Oct 3, 2016 at 12:11
  • 1
    You don't want to rely on default values. They change throughout distros/kernel versions. Make it nice and explicit, and you will never have to wonder what it's set to.
    – Marcin
    Oct 3, 2016 at 14:08
  • i'm unable to disable ip_forward permanently on ubuntu. Maybe your issue is related to mine: askubuntu.com/questions/1162147/…
    – Stefano Scoppa
    Aug 2, 2019 at 10:00

1 Answer 1

Reset to default
2

Is there a bigger reason to do what the recommendation says, other than to make sure the default parameter is set?

Similar to configuring firewall ACLs, the best practice is to explicitly configure the settings you want and not rely on the default (which may be different from device to device. For example, ACLs should end in deny all and log.

There are many reasons for being explicit in your configurations:

  • Not all systems have the same default value
  • Setting the desired value explicitly aids in accountability
  • Audit Requirements
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .