# Ensure packet redirect sending is disabled

Necessity: ICMP redirect messages are used by routers to inform hosts of more optimal routes on a network segment. However, an attacker on the same local network can craft malicious ICMP redirect packets to alter a host's routing table, potentially redirecting traffic through a malicious device. This can lead to Man-in-the-Middle (MITM) attacks, session hijacking, or denial of service. Disabling the sending of packet redirects prevents the system from being used to perpetrate these attacks, even if it is not a router. This is a critical hardening step for any non-router system to reduce the local network's attack surface. Auditing and Remediation: The audit script directly queries the kernel's live configuration using the 'sysctl' utility to read the value of 'net.ipv4.conf.all.send_redirects'. The remediation script sets this parameter, along with 'net.ipv4.conf.default.send_redirects' for comprehensive coverage, to the desired value in the live kernel and also writes the configuration to a file in '/etc/sysctl.d/' to ensure the setting persists across reboots. Recommended State Rationale: Basic: ['0']. This state disables the sending of packet redirects, which is the universally recommended secure setting for systems that are not explicitly configured to act as routers. Moderate: ['0']. There is no intermediate secure state for this setting. It is a binary choice between secure (disabled) and insecure (enabled for non-routers). Strict: ['0']. The strictest and only recommended secure configuration is to have this feature disabled ('0'). Any system not performing routing functions should have this disabled to prevent its use in network-level attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the 'sysctl' command to query the current value of the 'net.ipv4.conf.all.send_redirects' kernel parameter. The script must output only the numerical value (e.g., '0' or '1') without any additional text or labels.

## Remediation Script Working

Bash script that accepts a single numerical argument (e.g., '0' or '1'). The script must set both 'net.ipv4.conf.all.send_redirects' and 'net.ipv4.conf.default.send_redirects' kernel parameters to this value. The change must be applied to the running configuration using 'sysctl -w' and made persistent by adding or updating the settings in a file within '/etc/sysctl.d/'. The script must output 'true' on successful application and 'false' on failure.

