# Ensure secure icmp redirects are not accepted

Necessity: ICMP redirect messages can be used by an attacker on the same network segment to manipulate a host's routing table, potentially redirecting traffic through a malicious device for a Man-in-the-Middle (MitM) attack. Even 'secure' redirects, which only accept messages from gateways on the current default route list, can be subverted. Disabling the acceptance of these redirects entirely mitigates the risk of an attacker illegitimately rerouting network traffic. Auditing and Remediation: The audit script checks the live kernel value of the 'net.ipv4.conf.all.secure_redirects' parameter. The remediation script disables this feature by setting the value to '0' for both the live configuration ('all' and 'default' interfaces) and making the change persistent across reboots by writing it to a sysctl configuration file. Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is '0'. This is a binary security control; it is either enabled or disabled. The secure configuration is to disable it ('0') to prevent route table manipulation attacks. There is no less secure but acceptable state, so the recommendation is consistent across all hardening levels as per CIS and other security benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to query the system's current value for the 'net.ipv4.conf.all.secure_redirects' kernel parameter using the 'sysctl -n' command. The script must output only the numerical value (e.g., '0' or '1') with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single numerical argument ('0' or '1'). The script must set the runtime value of both 'net.ipv4.conf.all.secure_redirects' and 'net.ipv4.conf.default.secure_redirects' to this argument using 'sysctl -w'. It must also ensure this setting is persistent by creating or updating a configuration file in '/etc/sysctl.d/' with the required settings. The script must output 'true' on success and 'false' on failure.

