| name | cis-ubuntu1804-v220-3-4-3-3-4 |
| description | Ensure ip6tables firewall rules exist for all open ports |
| category | cis-networking |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","networking","firewall","iptables","ipv6"] |
| cis_id | 3.4.3.3.4 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.4.3.3.4
Description
Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.
Rationale
Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports.
Impact
- Changing firewall settings while connected over network can result in being locked out of the system
- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well
- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy
Audit Procedure
Command Line
Run the following command to determine open ports:
ss -6tuln
Run the following command to determine firewall rules:
ip6tables -L INPUT -v -n
Verify all open ports listening on non-localhost addresses have at least one firewall rule.
-OR-
Verify IPv6 is disabled:
Run the following script. Output will confirm if IPv6 is enabled on the system.
#!/usr/bin/bash
{
if grep -Pqs '^\h*0\b' /sys/module/ipv6/parameters/disable; then
echo -e " - IPv6 is enabled on the system"
else
echo -e " - IPv6 is not enabled on the system"
fi
}
Expected Result
Each open IPv6 port should have a corresponding ip6tables rule. Or IPv6 is not enabled on the system.
Remediation
Command Line
For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:
ip6tables -A INPUT -p <protocol> --dport <port> -m state --state NEW -j ACCEPT
Default Value
No firewall rules are configured by default.
References
- NIST SP 800-53 Rev. 5: CA-9, SC-7
- CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
CIS Controls
Version 8
4.4 Implement and Manage a Firewall on Servers - Implement and manage a firewall on servers, where supported.
