# Ensure bogus icmp responses are ignored

Necessity: This setting protects the system from network attacks that use forged ICMP (Internet Control Message Protocol) error messages. Attackers can send bogus ICMP error packets to disrupt network connections, perform reconnaissance, or cause a denial of service. By enabling 'icmp_ignore_bogus_error_responses', the kernel will discard these invalid packets, hardening the system against certain network scanning techniques and connection disruption attacks. Leaving this disabled increases the system's vulnerability to network-level manipulation. Auditing and Remediation: The audit script directly checks the value of the 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter. The remediation script sets this parameter to '1', making the change active immediately and also adding it to a persistent sysctl configuration file to ensure it is reapplied after a system reboot. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '1' (enabled). This is a binary security setting with no degrees of hardening; it is either secure (enabled) or insecure (disabled). Security benchmarks like CIS mandate enabling this feature as a fundamental step in securing the network stack. As there are no legitimate use cases or performance trade-offs for accepting bogus ICMP responses, the most secure configuration is consistently recommended for all security levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's current setting for 'net.ipv4.icmp_ignore_bogus_error_responses' using 'sysctl -n net.ipv4.icmp_ignore_bogus_error_responses'. The script must output only the numerical value (e.g., '1' or '0') without any additional text or formatting.

## Remediation Script Working

Develop a Bash script that accepts a single numerical argument (e.g., '1'). The script must update the live kernel parameter using 'sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=$1' and ensure the setting persists across reboots by adding or updating the line 'net.ipv4.icmp_ignore_bogus_error_responses = $1' in a configuration file within '/etc/sysctl.d/'. The script must output 'true' upon successful application of the setting, and 'false' if it fails.

