documentation_complete: true

prodtype: rhel7,fedora

title: 'Configure Kernel Parameter for Accepting ICMP Redirects for All Interfaces'

description: '<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />'

rationale: "ICMP redirect messages are used by routers to inform hosts that a more direct\nroute exists for a particular destination. These messages modify the host's route table \nand are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle\nattack.\n<br />\nThis feature of the IPv4 protocol has few legitimate uses. It should be disabled unless \nabsolutely required."

severity: medium

identifiers:
    cce@rhel7: 80158-9

references:
    cis: 3.2.2
    cjis: 5.10.1.1
    cui: 3.1.20
    disa: 366,1503,1551
    nist: CM-6(d),CM-7,SC-5
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040641"

ocil: '<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />'
