MediumOS hardeningBLWK-KERNEL-018

Reverse-path filtering is disabled

What this means

net.ipv4.conf.all.rp_filter is 0 — the kernel will forward packets whose source address couldn't possibly have arrived via the interface they came in on, which is exactly the condition IP spoofing depends on. (A value of 1 or 2 — strict or loose mode — is fine; this only fires when filtering is fully off.)

How to fix it

Set net.ipv4.conf.all.rp_filter=2 (loose mode) via /etc/sysctl.d/ and run sysctl --system. Use 1 (strict) only on single-homed hosts — strict reverse-path filtering drops legitimate traffic on multi-homed servers and any asymmetric-routing setup, which is exactly the server class most likely to be affected, so loose is the safe default that still blocks spoofing.

Check it yourself

Run a scan and look for BLWK-KERNEL-018 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sysctl_kernel and reports this check when:

rp_filter == 0

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 3.2.4

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001