cis-ubuntu2004-v300-3-3-1

name	cis-ubuntu2004-v300-3-3-1
description	Ensure ip forwarding is disabled
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","kernel-parameter"]
cis_id	3.3.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

3.3.1 Ensure ip forwarding is disabled (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

The net.ipv4.ip_forward and net.ipv6.conf.all.forwarding flags are used to tell the system whether it can forward packets or not.

Rationale

Setting net.ipv4.ip_forward and net.ipv6.conf.all.forwarding to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.

Impact

IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.

Many Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding.

Audit Procedure

Command Line

Run the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:

• net.ipv4.ip_forward is set to 0
• net.ipv6.conf.all.forwarding is set to 0

Note:

• kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that "correct" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.
• IPv6 kernel parameters only apply to systems where IPv6 is enabled

#!/usr/bin/env bash

{
  a_output=(); a_output2=(); l_ipv6_disabled=""
  l_systemdsysctl="$(readlink -f /lib/systemd/systemd-sysctl || readlink -f /usr/lib/systemd/systemd-sysctl)"
  a_parlist=("net.ipv4.ip_forward=0" "net.ipv6.conf.all.forwarding=0")
  l_ufwscf="$([ -f /etc/default/ufw ] && awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
  f_ipv6_chk()
  {
      l_ipv6_disabled=
      ! grep -Pqs --  /sys/module/ipv6/parameters/disable && l_ipv6_disabled=
       sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs --
 && \
          sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs --
; 
          l_ipv6_disabled=
      
  }
  ()
  {
      l_running_parameter_value= 
       grep -Pq --  <<< ; 
          a_output+=(
)
      
          a_output2+=( \
 \
)
      
       A_out;  -A A_out 
        -r l_out; 
           [ -n  ]; 
               [[  =~ ^\s*# ]]; 
                  l_file=
              
                  l_kpar=
                  [  =  ] && A_out+=([]=)
              
          
       < <( --cat-config | grep -Po )
       [ -n  ];  
          l_kpar=
          l_kpar=
          [  =  ] && A_out+=([]=)
      
       ((  >  ));  
           IFS=  -r l_fkpname l_file_parameter_value; 
              l_fkpname=; l_file_parameter_value=
               grep -Pq --  <<< ; 
                  a_output+=( \
)
              
                  a_output2+=( \
 \
)
              
           < <(grep -Po --  )
      
          a_output2+=( \
)
      
  }
   IFS=  -r l_parameter_name l_parameter_value;  
      l_parameter_name=; l_parameter_value=
      l_value_out=; l_value_out=
      l_value_out=
       grep -q  <<< ; 
          [ -z  ] && f_ipv6_chk
           [  =  ]; 
              a_output+=()
          
              f_kernel_parameter_chk
          
      
          f_kernel_parameter_chk
      
   < <(  )
   [  -le 0 ]; 
            
  
            
      [  -gt 0 ] &&      
  
}