cis-ubuntu1804-v220-3-4-2-1

name	cis-ubuntu1804-v220-3-4-2-1
description	Ensure nftables is installed
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","networking","firewall","nftables"]
cis_id	3.4.2.1
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.4.2.1

Description

nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queueing component and logging subsystem.

Rationale

nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Impact

None.

Audit Procedure

Command Line

Run the following command to verify that nftables is installed:

dpkg-query -s nftables | grep 'Status: install ok installed'

Expected Result

Status: install ok installed

Remediation

Command Line

Run the following command to install nftables:

apt install nftables

Default Value

nftables is not installed by default.

References

1. NIST SP 800-53 Rev. 5: CA-9, SC-7
2. CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0

CIS Controls

Version 8

4.4 Implement and Manage a Firewall on Servers - Implement and manage a firewall on servers, where supported.

4.5 Implement and Manage a Firewall on End-User Devices - Implement and manage a host-based firewall or port-filtering tool on end-user devices.

Version 7

9.4 Apply Host-based Firewalls or Port Filtering - Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Assessment Status

Automated