V-238367

Discussion

Denial of service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of the operating system to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.

Check Content

Verify an application firewall is configured to rate limit any connection to the system. 
 
Check all the services listening to the ports with the following command: 
 
$ sudo ss -l46ut 
 
Netid               State                Recv-Q                Send-Q                               Local Address:Port                               Peer Address:Port               Process                
tcp                 LISTEN               0                     128                                           [::]:ssh                                        [::]:* 
 
For each entry, verify that the Uncomplicated Firewall is configured to rate limit the service ports with the following command: 
 
$ sudo ufw status 
 
Status: active 
 
To                         Action      From 
--                         ------      ---- 
22/tcp                     LIMIT       Anywhere                   
22/tcp (v6)                LIMIT       Anywhere (v6) 
 
If any port with a state of "LISTEN" is not marked with the "LIMIT" action, this is a finding.