BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-10-800280 RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.

DISA STIG library V1R3
All changes in this version
first version loaded CAT II

Maps to SC-5 via CCI-002385, CCI-001115

Title

RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.

Control

Note: If IPv6 is disabled on the system, this requirement is not applicable. Verify RHEL 10 does not accept IPv6 source-routed packets by default. Check the value of the "net.ipv6.conf.default.accept_source_route" variables with the following command: $ sudo sysctl net.ipv6.conf.default.accept_source_route net.ipv6.conf.default.accept_source_route = 0 If "net.ipv6.conf.default.accept_source_route" is not set to "0" or is missing, this is a finding.

Discussion

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It must be disabled unless it is absolutely required. Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00091

Related controls

CCI-001115, CCI-002385

Fix

Configure RHEL 10 to not accept IPv6 source-routed packets by default. Create a configuration file if it does not already exist: $ sudo vi /etc/sysctl.d/ipv6_accept_source_route.conf Add the following line to the file: net.ipv6.conf.default.accept_source_route = 0 Reload settings from all system configuration files with the following command: $ sudo sysctl --system