-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add CIS iptables rules #10121
Add CIS iptables rules #10121
Conversation
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_service_iptables_enabled'.
--- xccdf_org.ssgproject.content_rule_service_iptables_enabled
+++ xccdf_org.ssgproject.content_rule_service_iptables_enabled
@@ -396,9 +396,6 @@
[reference]:
PR.PT-4
-[reference]:
-3.5.3.1.1
-
[rationale]:
The iptables service provides the system's host-based firewalling
capability for IPv4 and ICMP.
New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
--- xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic
+++ xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic
@@ -14,6 +14,9 @@
[reference]:
Req-1.4.1
+[reference]:
+3.5.3.3.2
+
[rationale]:
Loopback traffic is generated between processes on machine and is
typically critical to operation of the system. The loopback interface
New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'.
--- xccdf_org.ssgproject.content_rule_set_loopback_traffic
+++ xccdf_org.ssgproject.content_rule_set_loopback_traffic
@@ -3,20 +3,20 @@
Set configuration for loopback traffic
[description]:
-Configure the loopback interface to accept traffic.
-Configure all other interfaces to deny traffic to the loopback
+Configure the loopback interface to accept traffic.
+Configure all other interfaces to deny traffic to the loopback
network.
[warning]:
-Changing firewall settings while connected over network can
+Changing firewall settings while connected over network can
result in being locked out of the system.
[reference]:
Req-1.4.1
[rationale]:
-Loopback traffic is generated between processes on machine and is
-typically critical to operation of the system. The loopback interface
-is the only place that loopback network traffic should be seen, all
+Loopback traffic is generated between processes on machine and is
+typically critical to operation of the system. The loopback interface
+is the only place that loopback network traffic should be seen, all
other interfaces should ignore traffic on this network as an
anti-spoofing measure.
OCIL for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic' differs.
--- ocil:ssg-set_loopback_traffic_ocil:questionnaire:1
+++ ocil:ssg-set_loopback_traffic_ocil:questionnaire:1
@@ -1,10 +1,12 @@
-Verify that the loopback interface is configured:
+Run the following commands and verify output:
-# nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
+# iptables -L INPUT -v -n | grep lo | grep ACCEPT
-If IPv6 is enabled, verify that the IPv6 loopback interface is configured:
-# nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
+# iptables -L INPUT -v -n | grep 127.0.0.0\/8 | grep DROP
+
+
+# iptables -L OUTPUT -v -n | grep lo | grep ACCEPT
Is it the case that loopback traffic is not configured?
New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR. There are a couple of items I found during my review.
linux_os/guide/system/network/network-iptables/package_iptables-persistent_removed/rule.yml
Outdated
Show resolved
Hide resolved
...x_os/guide/system/network/network-iptables/iptables_activation/set_loopback_traffic/rule.yml
Show resolved
Hide resolved
Co-authored-by: Matthew Burket <m@tthewburket.com>
Code Climate has analyzed commit 258dea1 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.5%. View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR! Override CODEOWNERS since @dodys can't merge this PR.
Automatus failures are expected due to the prodtype. |
Description:
Add new rules:
Add existing rules to Ubuntu CIS profile:
Remove Ubuntu from service_iptables_enabled
Rationale: