# Ensure bogus icmp responses are ignored

Necessity: This setting is crucial for mitigating network-level reconnaissance and denial-of-service attacks. Certain network scanning techniques rely on sending malformed or 'bogus' ICMP error messages to elicit responses that can reveal information about the network's topology or cause instability in the system's network stack. Enabling this setting instructs the kernel to silently discard these non-compliant packets, hardening the system against such attacks. Misconfiguration (leaving it disabled) exposes the system to a greater risk of network mapping and potential disruption.

Auditing and Remediation: The audit script directly queries the kernel's current runtime value for the 'net.ipv4.icmp_ignore_bogus_error_responses' parameter. The remediation script modifies this parameter in both the live kernel configuration for immediate effect and the persistent system configuration files (e.g., within '/etc/sysctl.d/') to ensure the setting survives reboots.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is '1' (enabled). This is a binary security control; it is either on or off. There is no security benefit to disabling this feature, as it only protects the system. Security standards like the CIS Benchmark universally recommend enabling this setting as a fundamental network hardening measure. Therefore, any secure configuration requires this value to be set to '1'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the command 'sysctl -n net.ipv4.icmp_ignore_bogus_error_responses' to retrieve the current value. The script must output only the numerical value (e.g., '1') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('0' or '1'). The script must set the 'net.ipv4.icmp_ignore_bogus_error_responses' parameter to this value for both the running system (using 'sysctl -w') and persistently (by writing to a file in '/etc/sysctl.d/'). It must return 'true' on success and 'false' on failure.

