CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

drop icmp timestamp replies https://github.com/Security-Onion-Solutions/securityonion/issues/1704

Browse Source
This commit is contained in:
m0duspwnens
2021-02-11 11:09:21 -05:00
parent 10553938b5
commit 7e4d7a6985
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
salt/firewall/init.sls
View File

@@ -34,7 +34,6 @@ iptables_allow_established:
- jump: ACCEPT - jump: ACCEPT
- match: conntrack - match: conntrack
- ctstate: 'RELATED,ESTABLISHED' - ctstate: 'RELATED,ESTABLISHED'
- save: True
# I like pings # I like pings
iptables_allow_pings: iptables_allow_pings:
@@ -43,7 +42,6 @@ iptables_allow_pings:
- chain: INPUT - chain: INPUT
- jump: ACCEPT - jump: ACCEPT
- proto: icmp - proto: icmp
- save: True
# Create the chain for logging # Create the chain for logging
iptables_LOGGING_chain: iptables_LOGGING_chain:
@@ -68,7 +66,6 @@ iptables_log_input_drops:
- table: filter - table: filter
- chain: INPUT - chain: INPUT
- jump: LOGGING - jump: LOGGING
- save: True
# Enable global DOCKER-USER block rule # Enable global DOCKER-USER block rule
enable_docker_user_fw_policy: enable_docker_user_fw_policy:
@@ -79,7 +76,6 @@ enable_docker_user_fw_policy:
- in-interface: '!docker0' - in-interface: '!docker0'
- out-interface: docker0 - out-interface: docker0
- position: 1 - position: 1
- save: True
enable_docker_user_established: enable_docker_user_established:
iptables.insert: iptables.insert:
@@ -89,7 +85,6 @@ enable_docker_user_established:
- in-interface: '!docker0' - in-interface: '!docker0'
- out-interface: docker0 - out-interface: docker0
- position: 1 - position: 1
- save: True
- match: conntrack - match: conntrack
- ctstate: 'RELATED,ESTABLISHED' - ctstate: 'RELATED,ESTABLISHED'
@@ -115,7 +110,6 @@ enable_docker_user_established:
{% if action == 'insert' %} {% if action == 'insert' %}
- position: 1 - position: 1
{% endif %} {% endif %}
- save: True
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}
@@ -126,6 +120,15 @@ enable_docker_user_established:
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}
# Block icmp timestamp response
block_icmp_timestamp_reply:
iptables.append:
- table: filter
- chain: OUTPUT
- jump: DROP
- proto: icmp
- icmp-type: 'timestamp-reply'
# Make the input policy send stuff that doesn't match to be logged and dropped # Make the input policy send stuff that doesn't match to be logged and dropped
iptables_drop_all_the_things: iptables_drop_all_the_things:
iptables.append: iptables.append: