[PATCH 2/4] Added sysctl remediation scripts

Shawn Wells shawn.d.wells at gmail.com
Sat Jun 1 21:20:22 UTC 2013


-------------- next part --------------
>From 352d44d0b5e5cf62c59cefb36fccf1f250957401 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 1 Jun 2013 16:13:08 -0400
Subject: [PATCH 2/4] Added sysctl remediation scripts
 - Updated template to reflect proper naming of sysctl scripts

Test when value not in /etc/sysctl.conf:
[root at rhel6 templates]# grep exec-shield /etc/sysctl.conf
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# grep exec-shield /etc/sysctl.conf
kernel.exec-shield = 1

Test when value incorrectly set:
[root at rhel6 templates]# grep exec-shield /etc/sysctl.conf
kernel.exec-shield = 0
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# grep exec-shield /etc/sysctl.conf
kernel.exec-shield = 1

Testing for sequential running (e.g. no duplicate output to sysctl):
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# bash output/sysctl_kernel_exec_shield.sh
[root at rhel6 templates]# tail /etc/sysctl.conf
kernel.msgmax = 65536

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

kernel.exec-shield = 1

Also, just to test that scripts get gen'd correctly:
[root at rhel6 output]# oscap xccdf eval --profile stig-rhel6-server --cpe ssg-rhel6-cpe-dictionary.xml --results /var/www/html/results/results.xml --report /var/www/html/report.html ssg-rhel6-xccdf.xml; oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server /var/www/html/results/results.xml
....

sysctl -q -n -w net.ipv4.conf.all.rp_filter=1

if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then
        sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf
else
        echo "" >> /etc/sysctl.conf
        echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf
        echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf
fi
....
---
 .../fixes/bash/set_sysctl_kernel_exec_shield.sh    |   16 ++++++++++++++++
 .../bash/set_sysctl_kernel_randomize_va_space.sh   |   16 ++++++++++++++++
 ...et_sysctl_net_ipv4_conf_all_accept_redirects.sh |   16 ++++++++++++++++
 ...sysctl_net_ipv4_conf_all_accept_source_route.sh |   16 ++++++++++++++++
 .../set_sysctl_net_ipv4_conf_all_log_martians.sh   |   16 ++++++++++++++++
 .../bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh |   16 ++++++++++++++++
 ...et_sysctl_net_ipv4_conf_all_secure_redirects.sh |   16 ++++++++++++++++
 .../set_sysctl_net_ipv4_conf_all_send_redirects.sh |   16 ++++++++++++++++
 ...ysctl_net_ipv4_conf_default_accept_redirects.sh |   16 ++++++++++++++++
 ...tl_net_ipv4_conf_default_accept_source_route.sh |   16 ++++++++++++++++
 .../set_sysctl_net_ipv4_conf_default_rp_filter.sh  |   16 ++++++++++++++++
 ...ysctl_net_ipv4_conf_default_secure_redirects.sh |   16 ++++++++++++++++
 ..._sysctl_net_ipv4_conf_default_send_redirects.sh |   16 ++++++++++++++++
 ..._sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh |   16 ++++++++++++++++
 ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh |   16 ++++++++++++++++
 .../fixes/bash/set_sysctl_net_ipv4_ip_forward.sh   |   16 ++++++++++++++++
 .../bash/set_sysctl_net_ipv4_tcp_syncookies.sh     |   16 ++++++++++++++++
 .../fixes/bash/templates/create_sysctl_bash.py     |    2 +-
 18 files changed, 273 insertions(+), 1 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh
 create mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh

diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh
new file mode 100644
index 0000000..66142d7
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for kernel.exec-shield
+#
+sysctl -q -n -w kernel.exec-shield=1
+
+#
+# If kernel.exec-shield present in /etc/sysctl.conf, change value to "1"
+#	else, add "kernel.exec-shield = 1" to /etc/sysctl.conf
+#
+if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then
+	sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf
+	echo "kernel.exec-shield = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh
new file mode 100644
index 0000000..9e600c0
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for kernel.randomize_va_space
+#
+sysctl -q -n -w kernel.randomize_va_space=2
+
+#
+# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
+#	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
+#
+if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then
+	sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set kernel.randomize_va_space to 2 per security requirements" >> /etc/sysctl.conf
+	echo "kernel.randomize_va_space = 2" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh
new file mode 100644
index 0000000..2fad04e
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.accept_redirects
+#
+sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0
+
+#
+# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.all.accept_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh
new file mode 100644
index 0000000..54a9746
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.accept_source_route
+#
+sysctl -q -n -w net.ipv4.conf.all.accept_source_route=0
+
+#
+# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.all.accept_source_route = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.accept_source_route /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh
new file mode 100644
index 0000000..9388226
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.log_martians
+#
+sysctl -q -n -w net.ipv4.conf.all.log_martians=1
+
+#
+# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.conf.all.log_martians = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh
new file mode 100644
index 0000000..81eb072
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.rp_filter
+#
+sysctl -q -n -w net.ipv4.conf.all.rp_filter=1
+
+#
+# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.conf.all.rp_filter = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh
new file mode 100644
index 0000000..002d19f
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.secure_redirects
+#
+sysctl -q -n -w net.ipv4.conf.all.secure_redirects=0
+
+#
+# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.all.secure_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.secure_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.secure_redirects.*/net.ipv4.conf.all.secure_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh
new file mode 100644
index 0000000..842dbcb
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.all.send_redirects
+#
+sysctl -q -n -w net.ipv4.conf.all.send_redirects=0
+
+#
+# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh
new file mode 100644
index 0000000..a1403b5
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.default.accept_redirects
+#
+sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0
+
+#
+# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.default.accept_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh
new file mode 100644
index 0000000..0bb5b0f
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.default.accept_source_route
+#
+sysctl -q -n -w net.ipv4.conf.default.accept_source_route=0
+
+#
+# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.default.accept_source_route = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.default.accept_source_route /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.default.accept_source_route.*/net.ipv4.conf.default.accept_source_route = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.default.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh
new file mode 100644
index 0000000..89795c4
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.default.rp_filter
+#
+sysctl -q -n -w net.ipv4.conf.default.rp_filter=1
+
+#
+# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.conf.default.rp_filter = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.default.rp_filter /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.default.rp_filter to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh
new file mode 100644
index 0000000..2230dc5
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.default.secure_redirects
+#
+sysctl -q -n -w net.ipv4.conf.default.secure_redirects=0
+
+#
+# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.default.secure_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.default.secure_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.default.secure_redirects.*/net.ipv4.conf.default.secure_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.default.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh
new file mode 100644
index 0000000..6009c0d
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.conf.default.send_redirects
+#
+sysctl -q -n -w net.ipv4.conf.default.send_redirects=0
+
+#
+# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
new file mode 100644
index 0000000..2d737fa
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
+#
+sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1
+
+#
+# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
new file mode 100644
index 0000000..6cb96fa
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
+#
+sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses=1
+
+#
+# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.icmp_ignore_bogus_error_responses = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.icmp_ignore_bogus_error_responses.*/net.ipv4.icmp_ignore_bogus_error_responses = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.icmp_ignore_bogus_error_responses to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh
new file mode 100644
index 0000000..3292a63
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.ip_forward
+#
+sysctl -q -n -w net.ipv4.ip_forward=0
+
+#
+# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
+#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh
new file mode 100644
index 0000000..456870c
--- /dev/null
+++ b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh
@@ -0,0 +1,16 @@
+#
+# Set runtime for net.ipv4.tcp_syncookies
+#
+sysctl -q -n -w net.ipv4.tcp_syncookies=1
+
+#
+# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to "1"
+#	else, add "net.ipv4.tcp_syncookies = 1" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv4.tcp_syncookies /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf
+else
+	echo "" >> /etc/sysctl.conf
+	echo "# Set net.ipv4.tcp_syncookies to 1 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
+fi
diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
index 4d42ed3..6eae9ae 100755
--- a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
+++ b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py
@@ -14,7 +14,7 @@ def output_checkfile(serviceinfo):
         filestring = filestring.replace("SYSCTLVAR", sysctl_var)
         filestring = filestring.replace("SYSCTLVAL", sysctl_val)
         # write the check
-        with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile:
+        with open("./output/set_sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile:
             outputfile.write(filestring)
             outputfile.close()
 
-- 
1.7.1



More information about the scap-security-guide mailing list