# Ensure broadcast icmp requests are ignored

Necessity: This setting is crucial for preventing the system from being used as an amplifier in a type of Distributed Denial of Service (DDoS) attack known as a 'Smurf attack'. In this attack, an adversary sends a large number of ICMP Echo Request packets (pings) to a network's broadcast address while spoofing the source IP to be the victim's address. All systems on the network that respond to broadcast pings will then reply to the victim, overwhelming it with traffic. By setting the system to ignore these broadcast requests, it will not participate in such an attack, thus protecting other networks. The risk of misconfiguration is that the host can become an unwitting accomplice in a DDoS attack. 

Auditing and Remediation: The audit script directly inspects the live value of the 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter. The remediation script sets this value to '1', which instructs the kernel to drop all ICMP Echo Requests sent to broadcast or multicast addresses. It also ensures this setting is written to a configuration file in '/etc/sysctl.d/' to make it persistent across system reboots. 

Recommended State Rationale: 
- Basic: ['1']. This is the universally recommended secure state. Enabling this setting is a fundamental step in network hardening and is recommended by security benchmarks like CIS. 
- Moderate: ['1']. As this is a binary setting (either on or off), the only secure state is '1'. There is no intermediate configuration. 
- Strict: ['1']. In a strict security environment, it is imperative to disable any functionality that could be abused for network attacks. Therefore, the setting remains at '1', as this is the most secure configuration possible for this parameter.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's runtime configuration for the 'net.ipv4.icmp_echo_ignore_broadcasts' parameter using the 'sysctl -n' command. The script must output only the raw numerical value (e.g., '1' or '0') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('1' or '0') for the 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter. The script must use 'sysctl -w' to set the runtime value and also update or create an entry in a file within '/etc/sysctl.d/' to ensure the setting persists across reboots. The script should output 'true' on successful application of the setting, and 'false' if it fails.

