cis-gcp-cos-3-2-6

name	cis-gcp-cos-3.2.6
description	Ensure bogus ICMP responses are ignored
category	cis-gcp-cos
version	1.2.0
author	cyberstrike-official
tags	["cis","gcp","container-optimized-os","network","sysctl","icmp"]
cis_id	3.2.6
cis_benchmark	CIS Google Container-Optimized OS Benchmark v1.2.0
tech_stack	["gcp","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

3.2.6 Ensure bogus ICMP responses are ignored (Automated)

Description

Setting icmp_ignore_bogus_error_responses to 1 prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages.

Rationale

Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages.

Audit Procedure

Run the following commands and verify output matches:

# sysctl net.ipv4.icmp_ignore_bogus_error_responses

net.ipv4.icmp_ignore_bogus_error_responses = 1
# grep "net.ipv4.icmp_ignore_bogus_error_responses" /etc/sysctl.conf /etc/sysctl.d/*

net.ipv4.icmp_ignore_bogus_error_responses = 1

Expected Result

The sysctl command should return a value of 1 and the grep command should confirm the setting is persisted in the sysctl configuration files.

Remediation

Set the following parameter in /etc/sysctl.conf or a /etc/sysctl.d/* file:

net.ipv4.icmp_ignore_bogus_error_responses = 1

Run the following commands to set the active kernel parameters:

# sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
# sysctl -w net.ipv4.route.flush=1

/etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	12.2 Establish and Maintain a Secure Network Architecture - Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum.		X	X
v7	5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software.	X	X	X

Profile