>From 352d44d0b5e5cf62c59cefb36fccf1f250957401 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 1 Jun 2013 16:13:08 -0400 Subject: [PATCH 2/4] Added sysctl remediation scripts - Updated template to reflect proper naming of sysctl scripts Test when value not in /etc/sysctl.conf: [root@rhel6 templates]# grep exec-shield /etc/sysctl.conf [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# grep exec-shield /etc/sysctl.conf kernel.exec-shield = 1 Test when value incorrectly set: [root@rhel6 templates]# grep exec-shield /etc/sysctl.conf kernel.exec-shield = 0 [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# grep exec-shield /etc/sysctl.conf kernel.exec-shield = 1 Testing for sequential running (e.g. no duplicate output to sysctl): [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh [root@rhel6 templates]# tail /etc/sysctl.conf kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 kernel.exec-shield = 1 Also, just to test that scripts get gen'd correctly: [root@rhel6 output]# oscap xccdf eval --profile stig-rhel6-server --cpe ssg-rhel6-cpe-dictionary.xml --results /var/www/html/results/results.xml --report /var/www/html/report.html ssg-rhel6-xccdf.xml; oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server /var/www/html/results/results.xml .... sysctl -q -n -w net.ipv4.conf.all.rp_filter=1 if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf else echo "" >> /etc/sysctl.conf echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf fi .... --- .../fixes/bash/set_sysctl_kernel_exec_shield.sh | 16 ++++++++++++++++ .../bash/set_sysctl_kernel_randomize_va_space.sh | 16 ++++++++++++++++ ...et_sysctl_net_ipv4_conf_all_accept_redirects.sh | 16 ++++++++++++++++ ...sysctl_net_ipv4_conf_all_accept_source_route.sh | 16 ++++++++++++++++ .../set_sysctl_net_ipv4_conf_all_log_martians.sh | 16 ++++++++++++++++ .../bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh | 16 ++++++++++++++++ ...et_sysctl_net_ipv4_conf_all_secure_redirects.sh | 16 ++++++++++++++++ .../set_sysctl_net_ipv4_conf_all_send_redirects.sh | 16 ++++++++++++++++ ...ysctl_net_ipv4_conf_default_accept_redirects.sh | 16 ++++++++++++++++ ...tl_net_ipv4_conf_default_accept_source_route.sh | 16 ++++++++++++++++ .../set_sysctl_net_ipv4_conf_default_rp_filter.sh | 16 ++++++++++++++++ ...ysctl_net_ipv4_conf_default_secure_redirects.sh | 16 ++++++++++++++++ ..._sysctl_net_ipv4_conf_default_send_redirects.sh | 16 ++++++++++++++++ ..._sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh | 16 ++++++++++++++++ ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh | 16 ++++++++++++++++ .../fixes/bash/set_sysctl_net_ipv4_ip_forward.sh | 16 ++++++++++++++++ .../bash/set_sysctl_net_ipv4_tcp_syncookies.sh | 16 ++++++++++++++++ .../fixes/bash/templates/create_sysctl_bash.py | 2 +- 18 files changed, 273 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh new file mode 100644 index 0000000..66142d7 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh @@ -0,0 +1,16 @@ +# +# Set runtime for kernel.exec-shield +# +sysctl -q -n -w kernel.exec-shield=1 + +# +# If kernel.exec-shield present in /etc/sysctl.conf, change value to "1" +# else, add "kernel.exec-shield = 1" to /etc/sysctl.conf +# +if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then + sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf + echo "kernel.exec-shield = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh new file mode 100644 index 0000000..9e600c0 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh @@ -0,0 +1,16 @@ +# +# Set runtime for kernel.randomize_va_space +# +sysctl -q -n -w kernel.randomize_va_space=2 + +# +# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2" +# else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf +# +if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then + sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set kernel.randomize_va_space to 2 per security requirements" >> /etc/sysctl.conf + echo "kernel.randomize_va_space = 2" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh new file mode 100644 index 0000000..2fad04e --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.accept_redirects +# +sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0 + +# +# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.accept_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh new file mode 100644 index 0000000..54a9746 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.accept_source_route +# +sysctl -q -n -w net.ipv4.conf.all.accept_source_route=0 + +# +# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.accept_source_route = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.accept_source_route /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh new file mode 100644 index 0000000..9388226 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.log_martians +# +sysctl -q -n -w net.ipv4.conf.all.log_martians=1 + +# +# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.all.log_martians = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh new file mode 100644 index 0000000..81eb072 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.rp_filter +# +sysctl -q -n -w net.ipv4.conf.all.rp_filter=1 + +# +# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.all.rp_filter = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh new file mode 100644 index 0000000..002d19f --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.secure_redirects +# +sysctl -q -n -w net.ipv4.conf.all.secure_redirects=0 + +# +# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.secure_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.secure_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.secure_redirects.*/net.ipv4.conf.all.secure_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh new file mode 100644 index 0000000..842dbcb --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.send_redirects +# +sysctl -q -n -w net.ipv4.conf.all.send_redirects=0 + +# +# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh new file mode 100644 index 0000000..a1403b5 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.accept_redirects +# +sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0 + +# +# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.accept_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh new file mode 100644 index 0000000..0bb5b0f --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.accept_source_route +# +sysctl -q -n -w net.ipv4.conf.default.accept_source_route=0 + +# +# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.accept_source_route = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.accept_source_route /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.accept_source_route.*/net.ipv4.conf.default.accept_source_route = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh new file mode 100644 index 0000000..89795c4 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.rp_filter +# +sysctl -q -n -w net.ipv4.conf.default.rp_filter=1 + +# +# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.default.rp_filter = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.rp_filter /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.rp_filter to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh new file mode 100644 index 0000000..2230dc5 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.secure_redirects +# +sysctl -q -n -w net.ipv4.conf.default.secure_redirects=0 + +# +# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.secure_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.secure_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.secure_redirects.*/net.ipv4.conf.default.secure_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh new file mode 100644 index 0000000..6009c0d --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.send_redirects +# +sysctl -q -n -w net.ipv4.conf.default.send_redirects=0 + +# +# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh new file mode 100644 index 0000000..2d737fa --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts +# +sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1 + +# +# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh new file mode 100644 index 0000000..6cb96fa --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses +# +sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses=1 + +# +# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.icmp_ignore_bogus_error_responses = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.icmp_ignore_bogus_error_responses.*/net.ipv4.icmp_ignore_bogus_error_responses = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.icmp_ignore_bogus_error_responses to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh new file mode 100644 index 0000000..3292a63 --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.ip_forward +# +sysctl -q -n -w net.ipv4.ip_forward=0 + +# +# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh new file mode 100644 index 0000000..456870c --- /dev/null +++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.tcp_syncookies +# +sysctl -q -n -w net.ipv4.tcp_syncookies=1 + +# +# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.tcp_syncookies = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.tcp_syncookies /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.tcp_syncookies to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py index 4d42ed3..6eae9ae 100755 --- a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py +++ b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py @@ -14,7 +14,7 @@ def output_checkfile(serviceinfo): filestring = filestring.replace("SYSCTLVAR", sysctl_var) filestring = filestring.replace("SYSCTLVAL", sysctl_val) # write the check - with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile: + with open("./output/set_sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile: outputfile.write(filestring) outputfile.close() -- 1.7.1