# Ensure packet redirect sending is disabled

Necessity: ICMP redirect messages are used by routers to notify hosts of more optimal routes. However, an attacker can send forged ICMP redirect packets to a host, tricking it into sending traffic through a malicious system. This enables Man-in-the-Middle (MitM) attacks, allowing the attacker to intercept, inspect, or modify network traffic. Disabling the sending of packet redirects on a host (which is not typically a router) prevents it from being used to participate in or facilitate such network attacks. Auditing and Remediation: The audit script verifies the current state of the `net.ipv4.conf.all.send_redirects` and `net.ipv4.conf.default.send_redirects` kernel parameters. The remediation script modifies these parameters to the desired state (enabled or disabled) both in the live kernel configuration and in a persistent configuration file to ensure the setting survives a reboot. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is `['0']` (disabled). This is because any host that is not explicitly functioning as a router has no legitimate reason to send ICMP redirects. Enabling this feature provides no benefit and creates a significant security vulnerability. Therefore, the only secure configuration is to disable it entirely, which aligns with security best practices and benchmarks such as those from CIS (Center for Internet Security).

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the values of the `net.ipv4.conf.all.send_redirects` and `net.ipv4.conf.default.send_redirects` kernel parameters. If both values are `0`, the script must return `0`. Otherwise, it must return `1`. The output must be only the final value (`0` or `1`) with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument (`0` for disabled, `1` for enabled) to set the `net.ipv4.conf.all.send_redirects` and `net.ipv4.conf.default.send_redirects` kernel parameters. The script must apply the setting to the live system using `sysctl` and ensure it persists across reboots by creating a configuration file in `/etc/sysctl.d/`. The script must return `true` on successful application of the setting, and `false` otherwise.

