cis-ubuntu1604-v200-3-3-4

name	cis-ubuntu1604-v200-3-3-4
description	Ensure suspicious packets are logged
category	cis-networking
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","networking"]
cis_id	3.3.4
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 3.3.4

Description

When enabled, this feature logs packets with un-routable source addresses to the kernel log.

Rationale

Enabling this feature and logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.

Impact

None.

Audit Procedure

Command Line

Run the following commands and verify output matches:

sysctl net.ipv4.conf.all.log_martians

sysctl net.ipv4.conf.default.log_martians

grep "net\.ipv4\.conf\.all\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*

grep "net\.ipv4\.conf\.default\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*

Expected Result

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

And the grep commands should return:

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

Remediation

Command Line

Set the following parameters in /etc/sysctl.conf or a /etc/sysctl.d/* file:

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

Run the following commands to set the active kernel parameters:

sysctl -w net.ipv4.conf.all.log_martians=1
sysctl -w net.ipv4.conf.default.log_martians=1
sysctl -w net.ipv4.route.flush=1

Default Value

log_martians is disabled (set to 0) by default.

References

1. CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0

CIS Controls

Version 7

6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices.

6.3 Enable Detailed Logging - Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Assessment Status

Automated