>From 1342fe250b5ec41ce9b42398efc139782e1158f0 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 17 Apr 2014 22:33:43 -0400 Subject: [PATCH 13/15] Adding sysctl_net_ipv6_conf_all_accept_ra in support of C2S profile --- .../checks/sysctl_net_ipv6_conf_all_accept_ra.xml | 40 ++++++++++++++++++++ .../bash/sysctl_net_ipv6_conf_all_accept_ra.sh | 16 ++++++++ RHEL/6/input/profiles/C2S.xml | 2 +- 3 files changed, 57 insertions(+), 1 deletions(-) create mode 100644 RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml create mode 100644 RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh diff --git a/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml b/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml new file mode 100644 index 0000000..98da4b8 --- /dev/null +++ b/RHEL/6/input/checks/sysctl_net_ipv6_conf_all_accept_ra.xml @@ -0,0 +1,40 @@ + + + + + Kernel Runtime Parameter "net.ipv6.conf.all.accept_ra" Check + + Red Hat Enterprise Linux 6 + + The kernel runtime parameter "net.ipv6.conf.all.accept_ra" should be set to "0". + + + + + + + + + + + + + + + + + + + /etc/sysctl.conf + ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*0*$ + 1 + + + + net.ipv6.conf.all.accept_ra + + + + 0 + + diff --git a/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh b/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh new file mode 100644 index 0000000..aa26b85 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sysctl_net_ipv6_conf_all_accept_ra.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv6.conf.all.accept_ra +# +sysctl -q -n -w net.ipv6.conf.all.accept_ra=0 + +# +# If net.ipv6.conf.all.accept_ra present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv6.conf.all.accept_ra = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv6.conf.all.accept_ra /etc/sysctl.conf ; then + sed -i 's/^net.ipv6.conf.all.accept_ra.*/net.ipv6.conf.all.accept_ra = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv6.conf.all.accept_ra to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv6.conf.all.accept_ra = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.xml index 161321e..f32ebdf 100644 --- a/RHEL/6/input/profiles/C2S.xml +++ b/RHEL/6/input/profiles/C2S.xml @@ -334,7 +334,7 @@ Patches would be most welcome!