← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22409

CAT III (Low)

The system must not process Internet Control Message Protocol (ICMP) timestamp requests.

Rule ID

SV-45721r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-001551

Discussion

The processing of (ICMP) timestamp requests increases the attack surface of the system.

Check Content

Verify the system does not respond to ICMP TIMESTAMP_REQUESTs

Procedure:

# iptables -L INPUT | grep "timestamp"


This should return the following entries for "timestamp-reply" and "timestamp_request":
DROP       icmp --  anywhere             anywhere            icmp timestamp-request 
DROP       icmp --  anywhere             anywhere            icmp timestamp-reply

If either does not exist or does not "DROP" the message, this is a finding.

Fix Text

Configure the system to not respond to ICMP TIMESTAMP_REQUESTs. This is done by rejecting ICMP type 13 and 14 messages at the firewall.

Procedure:

1. Check the SuSEfirewall2 configuration to see if custom rules are being used:

# grep -v '^#' /etc/sysconfig/SuSEfirewall2 | grep FW_CUSTOMRULES

If the command returns FW_CUSTOMRULES=”” then no custom rules are being used.  In that case edit the /etc/sysconfig/SuSEfirewall2 file and use the vendor supplied file by setting FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"

2. Edit the file defined by the FW_CUSTOMRULES variable and add these commands to append the INPUT chain:

iptables -A INPUT -p ICMP --icmp-type timestamp-request -j DROP
iptables -A INPUT -p ICMP --icmp-type timestamp-reply -j DROP

Restart the firewall:

# rcSuSEfirewall2 restart