# Ensure icmp redirects are not accepted

Necessity: ICMP redirect packets are used by routers to inform hosts of a more efficient route to a destination. However, an attacker on the local network can forge these packets to manipulate a host's routing table, redirecting traffic through a malicious device. This can lead to man-in-the-middle (MITM) attacks, where sensitive data is intercepted, or denial-of-service (DoS) attacks. Disabling the acceptance of ICMP redirects mitigates this vulnerability, as servers and workstations are typically not routers and have no legitimate reason to process these messages. Auditing and Remediation: The audit script checks the live kernel parameter `net.ipv4.conf.all.accept_redirects` to see if the system is configured to ignore ICMP redirects. The remediation script disables this behavior by setting the value to `0` for both the `all` and `default` configurations, ensuring the change is active immediately and persists after a reboot. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is `['0']`. For this particular setting, there is no valid intermediate state; it should either be enabled (insecure for non-routers) or disabled (secure). A value of `0` completely disables the feature, providing the only secure configuration and aligning with security best practices and benchmarks like the CIS CentOS Linux Benchmark. Allowing ICMP redirects offers no benefit to a typical server or endpoint and introduces a significant security risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script using the `sysctl` command to query the current value of the `net.ipv4.conf.all.accept_redirects` kernel parameter. The script must output only the numerical value and nothing else.

## Remediation Script Working

bash script that accepts a single numerical value as a positional command-line argument. The script must set both `net.ipv4.conf.all.accept_redirects` and `net.ipv4.conf.default.accept_redirects` kernel parameters to this value. It should apply the setting immediately using `sysctl -w` and also ensure the setting is persistent across reboots by adding or updating the values in a file such as `/etc/sysctl.d/99-security.conf`. The script must return `true` on success and `false` on failure.

