Package: procps Version: 2:3.3.15-2 Severity: normal Tags: ipv6 Dear maintainers,
please consider changing the following things in the shipped sysctl.conf file. All of these things could easily be done by the user, but many users don't know enough about these things to recognize problems, and new installs should not have useless defaults. a) IPv4+6 accept_redirects Current file content: # Do not accept ICMP redirects (prevent MITM attacks) #net.ipv4.conf.all.accept_redirects = 0 #net.ipv6.conf.all.accept_redirects = 0 According to kernel documentation and source, for normal situations with forwarding=0: The IPv4 setting "all" is separate from the interface settings, and redirects are accepted if at least one of them is 1. (For IPv6, it seems all is ignored and just the interface setting is valid.) Therefore, both cases should not only set "all" (at least if uncommented), but "default" too. b) IPv4 source route Current file content: # Do not accept IP source route packets (we are not a router) #net.ipv4.conf.all.accept_source_route = 0 According to kernel documentation and source: The all-value is already 0 by default (this can be practically seen in a fresh Debian install too) And source routing gets only enabled if "both" the all value and the interface value are 1, so effectively it is disabled everywhere. Therefore, I suggest removing this commented part from sysctl.conf And btw. source routing is not specific to routers. c) IPv6 source route Current file content: #net.ipv6.conf.all.accept_source_route = 0 Again according to the docs etc., this is a very different setting from the IPv4 one. After what happened around the IPv6 "RH0" routing headers (which are not supported at all in Kernel anymore, and that's good), the possible setting values now are >= 0 for enabling something that is not a security problem, and <0 for disabling it completely. Default (for "all" and all interfaces) is 0, meaning securely enabled. Therefore, the sysctl.conf setting (if uncommented) would not unaccept anything like it says, and it can be removed too as it is default. And if not removed, it should set "default" too instead of just "all". Always see https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt etc. Thank you -- System Information: Debian Release: 10.5 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-10-amd64 (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages procps depends on: ii init-system-helpers 1.56+nmu1 ii libc6 2.28-10 ii libncurses6 6.1+20181013-2+deb10u2 ii libncursesw6 6.1+20181013-2+deb10u2 ii libprocps7 2:3.3.15-2 ii libtinfo6 6.1+20181013-2+deb10u2 ii lsb-base 10.2019051400 Versions of packages procps recommends: pn psmisc <none> procps suggests no packages. -- no debconf information
