# Ensure icmp redirects are not accepted

Necessity: ICMP redirect messages are used by routers to inform a host of a more direct route for a specific destination. While legitimate, this mechanism can be abused by a malicious actor on the local network to send forged redirect messages, creating a man-in-the-middle (MITM) attack. By tricking a host into sending traffic through a malicious device, an attacker can intercept, inspect, or modify sensitive data. Disabling the acceptance of ICMP redirects is a critical hardening step that mitigates this attack vector, especially for systems that are not themselves routers. The risk of misconfiguration is that the system becomes vulnerable to network traffic interception and manipulation. Auditing and Remediation: The audit script checks the value of the `net.ipv4.conf.all.accept_redirects` kernel parameter, which governs whether the system will process ICMP redirect packets. A value of '1' means it is enabled, and '0' means it is disabled. The remediation script modifies this setting by setting the parameter to '0' in both the live kernel configuration and in a persistent configuration file (e.g., `/etc/sysctl.d/99-security.conf`) to ensure the change survives a reboot. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '0' (disabled). There is no security benefit to enabling this feature on a standard server or workstation; its potential for misuse far outweighs its utility in most environments. Therefore, the only secure configuration is to disable it completely. This guidance is consistent across all major security benchmarks, including CIS, as the risk of MITM attacks is significant and the defense is straightforward. There is no intermediate 'Moderate' state; the setting is either secure ('0') or insecure ('1').

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `sysctl` command to retrieve the current value of the `net.ipv4.conf.all.accept_redirects` kernel parameter. The script must output only the numerical value (e.g., '0' or '1') and nothing else.

## Remediation Script Working

Bash script that accepts a single numerical value (e.g., '0') as a direct, positional command-line argument. The script must set both `net.ipv4.conf.all.accept_redirects` and `net.ipv4.conf.default.accept_redirects` kernel parameters to this value. The change must be applied to the running configuration using `sysctl -w` and made persistent by adding/updating the settings in a file within `/etc/sysctl.d/`. The script must output 'true' on success and 'false' on failure.

