back to labs
CIS: Harden Network Kernel Parameters
MediumLinux Security20-25 minThe brief
The CIS Benchmark's network section hardens how the kernel handles routing and ICMP. Set a persistent sysctl drop-in so the host refuses source-routed packets, logs martian (impossible-source) packets, ignores broadcast ICMP echoes, and enables reverse-path filtering. Grading reads the configured values the way a CIS-CAT scan would.
What you'll do
- net.ipv4.conf.all.accept_source_route = 0
- net.ipv4.conf.all.log_martians = 1
- net.ipv4.icmp_echo_ignore_broadcasts = 1
- net.ipv4.conf.all.rp_filter = 1
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.