openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/metadata/rhel7/RHEL-07-040350.rst
Major Hayden 716232cef6 [Docs] Securing sysctl configurations 
This patch provides documentation for:

  https://review.openstack.org/397877

Implements: blueprint security-rhel7-stig
Change-Id: I1719ccb5b9818f6477e515cba6b9d1d9b29e2ab4
2016-11-16 16:16:54 +00:00

710 B
Raw Blame History

---id: RHEL-07-040350 status: implemented tag: kernel ---

The tasks in this role set net.ipv4.conf.all.accept_source_route and net.ipv4.conf.default.accept_source_route to 0 by default. This prevents the system from forwarding source-routed IPv4 packets on all new and existing interfaces.

Deployers can opt out of this change by setting the following Ansible variable:

security_disallow_source_routed_packet_forward_ipv4: no

For more details on source routed packets, refer to the Red Hat documentation.