[PATCH 2/3] changed some iptables and ipv6 Rules to Groups

Jeffrey Blank scapafterhours at gmail.com
Thu May 2 03:49:58 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/network/iptables.xml |   44 +++++++++++++++++--------------
 RHEL6/input/system/network/ipv6.xml     |   22 +++++----------
 2 files changed, 31 insertions(+), 35 deletions(-)

diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 50df5b0..ef129f5 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -184,9 +184,11 @@ The output should be similar to the following:
 <ref nist="CM-7" disa="1109" />
 </Rule>
 
-<Rule id="iptables_icmp_disabled">
+<Group id="iptables_icmp_disabled">
 <title>Restrict ICMP Message Types</title>
-<description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages types can be restricted. To accept only ICMP echo reply, destination unreachable, and time exceeded messages, remove the line:<br />
+<description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages
+types can be restricted. To accept only ICMP echo reply, destination
+unreachable, and time exceeded messages, remove the line:<br />
 <pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</pre>
 and insert the lines:
 <pre>-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
@@ -194,22 +196,27 @@ and insert the lines:
 -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</pre>
 To allow the system to respond to pings, also insert the following line:
 <pre>-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</pre>
-Ping responses can also be limited to certain networks or hosts by using the -s option in the previous rule.
-Because IPv6 depends so heavily on ICMPv6, it is preferable to deny the ICMPv6 packets you know you
-don't need (e.g. ping requests) in <tt>/etc/sysconfig/ip6tables</tt>, while letting everything else through:
+Ping responses can also be limited to certain networks or hosts by using the -s
+option in the previous rule.  Because IPv6 depends so heavily on ICMPv6, it is
+preferable to deny the ICMPv6 packets you know you don't need (e.g. ping
+requests) in <tt>/etc/sysconfig/ip6tables</tt>, while letting everything else
+through:
 <pre>-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</pre>
-If you are going to statically configure the machine's address, it should ignore Router Advertisements which
-could add another IPv6 address to the interface or alter important network settings:
+If you are going to statically configure the machine's address, it should
+ignore Router Advertisements which could add another IPv6 address to the
+interface or alter important network settings:
 <pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
+Restricting ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not
+recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great
+care must be taken if any other ICMPv6 types are blocked.
 </description>
-<ref nist="CM-7" />
-<rationale>Restricting other ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not recommended because the operation-
-  of IPv6 depends heavily on ICMPv6. Thus, more care must be taken when blocking ICMPv6 types.</rationale>
-<!--<ident cce="26444-0" />-->
-<!--<oval id="iptables_icmp_disabled" />-->
-</Rule>
+<rationale>Restricting ICMP messages may make a system slightly less
+discoverable to an unsophisticated attacker but is not appropriate for many
+general-purpose use cases and can also make troubleshooting more difficult.
+</rationale> 
+</Group>
 
-<Rule id="iptables_log_and_drop_suspicious">
+<Group id="iptables_log_and_drop_suspicious">
 <title>Log and Drop Packets with Suspicious Source Addresses</title>
 <description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
 modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
@@ -252,10 +259,7 @@ If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your ne
 The following rule will log all traffic originating from a site-local address, which is deprecated address space:
 <pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</pre>
 </description>
-<!--<ident cce="26444-0" />-->
-<!--MANUAL<oval id="iptables_log_and_drop_suspicious" />-->
-<ref nist="AC-17,CM-7" />
-</Rule>
+</Group>
 
-</Group><!--<Group id="ruleset_modifications">-->
-</Group><!--<Group id="network-iptables">-->
+</Group>
+</Group>
diff --git a/RHEL6/input/system/network/ipv6.xml b/RHEL6/input/system/network/ipv6.xml
index a481269..240cc6f 100644
--- a/RHEL6/input/system/network/ipv6.xml
+++ b/RHEL6/input/system/network/ipv6.xml
@@ -209,11 +209,12 @@ auto-configuration or router advertisement.
 <ref nist="" />
 </Rule>
 
-<Rule id="network_ipv6_limit_requests">
-<title>Limit Network-Transmitted Configuration</title>
-<description>Add the following lines to <tt>/etc/sysctl.conf</tt> to limit the
-configuration information requested from other systems, and accepted from the
-network:
+<Group id="network_ipv6_limit_requests">
+<title>Limit Network-Transmitted Configuration if Using Static IPv6 Addresses</title>
+<description>To limit the configuration information requested from other
+systems and accepted from the network on a system that uses
+statically-configured IPv6 addresses, add the following lines to
+<tt>/etc/sysctl.conf</tt>:
 <pre>net.ipv6.conf.default.router_solicitations = 0
 net.ipv6.conf.default.accept_ra_rtr_pref = 0
 net.ipv6.conf.default.accept_ra_pinfo = 0
@@ -244,16 +245,7 @@ addresses can be assigned to each interface.  The default is 16, but it should
 be set to exactly the number of statically configured global addresses
 required.
 </description>
-<ident cce="27163-5" />
-<ident cce="27161-9" />
-<ident cce="27162-7" />
-<ident cce="27157-7" />
-<ident cce="27165-0" />
-<ident cce="27158-5" />
-<ident cce="27160-1" />
-<oval id="network_ipv6_limit_requests" />
-<ref nist="CM-7" />
-</Rule>
+</Group>
 
 </Group><!--<Group id="configuring_ipv6">-->
 </Group><!--<Group id="network-ipv6">-->
-- 
1.7.1



More information about the scap-security-guide mailing list