22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

398 Lotus Security Handbook<br />

Ignoring ICMP redirect messages<br />

A would-be attacker might try to redirect traffic from the organization’s servers to<br />

a different gateway or a non-existent gateway. Additionally, the would-be<br />

attacker might try to inject bogus routes into the server’s routing table.<br />

All these can be accomplished through the unassuming ICMP Redirect<br />

Message, and it is a very effective denial of service attack. In addition to blocking<br />

ICMP Redirect messages at the firewall, if the operating system supports it, the<br />

following additional layer of security of ignoring ICMP Redirect messages should<br />

be added:<br />

► With Solaris, use the following command:<br />

ndd -set /dev/ip ip_ignore_redirect 1<br />

► With GNU/Linux 2.4.x, the command is:<br />

echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects<br />

Disable sending of ICMP Redirect messages<br />

Only routers need to send ICMP Redirect messages. Because the organization’s<br />

DMZ servers and firewall are not routing any packets, there should be no reason<br />

to send them:<br />

► For Solaris, use the following command:<br />

ndd -set /dev/ip ip_send_redirects 0<br />

► For GNU/Linux 2.4.x, the command is:<br />

echo 0 > /proc/sys/net/ipv4/conf/ all/send_redirects<br />

Timestamp request broadcast<br />

An ICMP timestamp request (ICMP type 13) allows a system to query another for<br />

the current time. The return value is the number of milliseconds since midnight.<br />

ICMP timestamp requests have been used to synchronize clocks between<br />

systems rather than using the rdate command because the precision is better.<br />

Individual timestamp requests are normal, but there is no need for a system to<br />

respond to a broadcast request. Finally, NTP should be looked at in order to<br />

keep time synchronized between servers because it is much better at keeping<br />

the time, and allows for authentication and peering of multiple time sources,<br />

which makes it much harder to spoof. This makes it possible to ICMP type 13<br />

(timestamp request) and type 14 (timestamp reply) altogether:<br />

► With Solaris, use the following command:<br />

ndd -set /dev/ip ip_respond_to_timestamp_ broadcast 0

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!