The Photon operating system must not respond to IPv4 Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256568	PHTN-30-000099	SV-256568r887378_rule		Medium

Description
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.

STIG	Date
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide	2023-12-01

Details

Check Text ( C-60243r887376_chk )
At the command line, run the following command: # /sbin/sysctl -a --pattern ignore_broadcasts Expected result: net.ipv4.icmp_echo_ignore_broadcasts = 1 If the output does not match the expected result, this is a finding.

Fix Text (F-60186r887377_fix)
At the command line, run the following commands: # sed -i -e "/^net.ipv4.icmp_echo_ignore_broadcasts/d" /etc/sysctl.conf # echo net.ipv4.icmp_echo_ignore_broadcasts=1>>/etc/sysctl.conf # /sbin/sysctl --load