openstack/ansible-hardening
Code Issues Proposed changes

V-38537: Ignore ICMPv4 bogus error messages

Browse Source 
Implements: blueprint security-hardening

Change-Id: I203b74f711d7aafac2997fc19231931081834475
This commit is contained in:
Major Hayden 2015-10-07 15:52:08 -05:00
parent bfcf6c7423
commit 824eaa95f9
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/source/developer-notes/V-38537.rst Normal file
View File

@ -0,0 +1,2 @@
Ubuntu already ignores ICMPv4 bogus error messages by default. The role will
ensure that this default setting is maintained.

12
openstack-ansible-security/tasks/kernel.yml
View File

@ -13,6 +13,18 @@
# See the License for the specific language governing permissions and
# limitations under the License.
# This is the default in Ubuntu 14.04
- name: V-38537 - The system must ignore ICMPv4 bogus error responses
sysctl:
name: net.ipv4.icmp_ignore_bogus_error_responses
value: 1
state: present
sysctl_set: yes
tags:
- kernel
- cat3
- V-38537
# This is the default in Ubuntu 14.04
- name: V-38596 - Enable virtual address space randomization
sysctl: