LowOS hardeningBLWK-KERNEL-017

Martian packet logging is disabled

What this means

net.ipv4.conf.all.log_martians is 0 — packets with impossible/spoofed source addresses (no route back to the claimed source) are silently dropped instead of logged, losing an early signal of spoofing or scanning activity on the network.

How to fix it

Set net.ipv4.conf.all.log_martians=1 via /etc/sysctl.d/ and run sysctl --system.

Check it yourself

Run a scan and look for BLWK-KERNEL-017 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sysctl_kernel and reports this check when:

log_martians == 0

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 3.2.3

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001