# Ensure secure icmp redirects are not accepted

Necessity: ICMP redirect messages are used by routers to notify hosts of more optimal routes. However, an attacker on the same local network can forge these messages to redirect a victim's traffic through a malicious host, enabling man-in-the-middle (MITM) attacks. Even 'secure' redirects, which are meant to only be accepted from known gateways, can be exploited in compromised environments. Disabling the acceptance of secure ICMP redirects hardens the host against network-level traffic interception and manipulation attacks. Auditing and Remediation: The audit script directly queries the kernel's live value for the 'net.ipv4.conf.all.secure_redirects' parameter. The remediation script sets this value to '0', which instructs the kernel not to accept secure ICMP redirects. It modifies both the running configuration for immediate effect and the persistent configuration files (e.g., in '/etc/sysctl.d/') to ensure the setting is reapplied after a system reboot. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is '0'. This is a binary security setting where the only secure option is to disable the feature. Any value other than '0' (i.e., '1') would enable the functionality, reintroducing the attack vector. Therefore, security benchmarks like CIS uniformly recommend setting this parameter to '0' to eliminate the risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's current value for the 'net.ipv4.conf.all.secure_redirects' kernel parameter using the 'sysctl -n' command. The script must output only the numerical value and nothing else.

## Remediation Script Working

Bash script that accepts a single numerical argument. The script should set the 'net.ipv4.conf.all.secure_redirects' kernel parameter to the provided value. It must update the live system configuration using 'sysctl -w' and also ensure the setting persists across reboots by adding or updating the entry in a configuration file within '/etc/sysctl.d/'. The script must output 'true' upon successful application of the setting, or 'false' if it fails.

