securing oracle linux 9 article 14 securing network configuration and kernel parameters network and sysctl

وحید نوروزی سیستم عامل و زیرساخت 31 July 2026 Hits: 10

In the previous part

Configuring Job Schedulers (Cron & At)

was completed.

1. CIS Benchmark Requirements (Section 3)

3.1 Configure Network Devices
- 3.1.1 Ensure IPv6 status is identified (Manual)
- 3.1.2 Ensure wireless interfaces are disabled (Automated)
- 3.1.3 Ensure bluetooth services are not in use (Automated)
3.2 Configure Network Kernel Modules
- 3.2.1 Ensure dccp kernel module is not available (Automated)
- 3.2.2 Ensure tipc kernel module is not available (Automated)
- 3.2.3 Ensure rds kernel module is not available (Automated)
- 3.2.4 Ensure sctp kernel module is not available (Automated)
3.3 Configure Network Kernel Parameters
- 3.3.1 Ensure ip forwarding is disabled (Automated)
- 3.3.2 Ensure packet redirect sending is disabled (Automated)
- 3.3.3 Ensure bogus icmp responses are ignored (Automated)
- 3.3.4 Ensure broadcast icmp requests are ignored (Automated)
- 3.3.5 Ensure icmp redirects are not accepted (Automated)
- 3.3.6 Ensure secure icmp redirects are not accepted (Automated)
- 3.3.7 Ensure reverse path filtering is enabled (Automated)
- 3.3.8 Ensure source routed packets are not accepted (Automated)
- 3.3.9 Ensure suspicious packets are logged (Automated)
- 3.3.10 Ensure tcp syn cookies is enabled (Automated)
- 3.3.11 Ensure ipv6 router advertisements are not accepted (Automated)

2. Concept & Rationale

Concept: This section focuses on reducing the attack surface at the operating system's network layer. It involves blocking unnecessary physical communications (Wireless/Bluetooth) and disabling rarely used network kernel modules (such as dccp, sctp, rds, and tipc).

Security Reason: Unused modules may contain undiscovered vulnerabilities and increase the potential for exploitation. In addition, securely configuring network sysctl parameters protects the system against popular attacks such as Spoofing, Man-in-the-Middle (MITM via ICMP Redirects), and Denial of Service attacks (SYN Flooding).

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

Critical Conflict in RAC Environments (Item 3.2.3): The rds (Reliable Datagram Sockets) module is used in Oracle RAC architectures for high-performance intra-cluster communications (Interconnect), particularly over InfiniBand and RoCE networks. If this architecture is in use, the rds module must NOT be disabled. (In Standalone databases or Ethernet-based UDP RAC, disabling it is not a problem).
Potential Conflict with Routing Parameters (Item 3.3.7): Setting rp_filter (Reverse Path Filtering) strictly to 1 (Strict) in some complex Oracle cluster network architectures (with asymmetric routing) may cause Interconnect packets to be dropped. In these scenarios, the value 2 (Loose) should be used.
No Conflict with Other Items: Blocking Bluetooth and Wireless, as well as other ICMP parameters, do not interfere with Oracle operations.

4. Checking the Current Status (Audit Script)

The following script checks the status of network modules, wireless services, and kernel parameters:

GitHub link:

modules/audit_14_Network_Sysctl_Parameters.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit14.sh
# Purpose: Audit Script for Network & Sysctl (CIS 3)

echo "=========================================================================="
echo " CIS Requirement: 3 Network Configuration"
echo " - Ensure wireless/bluetooth and uncommon network protocols are disabled."
echo " - Ensure network sysctl parameters are securely configured."
echo " Oracle Context:"
echo " - ACCEPTED EXCEPTION: 'net.ipv4.conf.all.rp_filter' and 'default.rp_filter'"
echo "   are expected to be '2' (Loose) instead of '1' (Strict) due to Oracle"
echo "   RAC/Clusterware interconnect requirements."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] Checking Wireless and Bluetooth..."
if nmcli radio all 2>/dev/null | grep -q "enabled"; then
    echo -e "  \e[31m[FAIL]\e[0m Wireless interfaces are not completely disabled."
    FAIL_COUNT=$((FAIL_COUNT + 1))
else
    echo -e "  \e[32m[PASS]\e[0m Wireless interfaces are disabled."
fi

if systemctl is-active bluetooth.service &>/dev/null; then
    echo -e "  \e[31m[FAIL]\e[0m Bluetooth service is active."
    FAIL_COUNT=$((FAIL_COUNT + 1))
else
    echo -e "  \e[32m[PASS]\e[0m Bluetooth service is inactive."
fi

echo -e "\n[*] Checking Network Modules (dccp, tipc, rds, sctp)..."
for mod in dccp tipc rds sctp; do
    if modprobe -n -v "$mod" 2>/dev/null | grep -q "install /bin/true"; then
        echo -e "  \e[32m[PASS]\e[0m Module $mod is disabled."
    else
        echo -e "  \e[31m[FAIL]\e[0m Module $mod is NOT properly disabled."
        FAIL_COUNT=$((FAIL_COUNT + 1))
    fi
done

echo -e "\n[*] Checking Network sysctl parameters..."
# rp_filter is set to 2 to comply with Oracle Preinstall requirements
params=(
    "net.ipv4.ip_forward=0"
    "net.ipv6.conf.all.forwarding=0"
    "net.ipv4.conf.all.send_redirects=0"
    "net.ipv4.icmp_ignore_bogus_error_responses=1"
    "net.ipv4.icmp_echo_ignore_broadcasts=1"
    "net.ipv4.conf.all.accept_redirects=0"
    "net.ipv4.conf.all.secure_redirects=0"
    "net.ipv4.conf.all.rp_filter=2" 
    "net.ipv4.conf.all.accept_source_route=0"
    "net.ipv4.conf.all.log_martians=1"
    "net.ipv4.tcp_syncookies=1"
    "net.ipv6.conf.all.accept_ra=0"
)

for p in "${params[@]}"; do
    key=$(echo "$p" | cut -d= -f1)
    expected=$(echo "$p" | cut -d= -f2)
    actual=$(sysctl -n "$key" 2>/dev/null)
    
    if [ "$actual" = "$expected" ]; then
        if [ "$key" == "net.ipv4.conf.all.rp_filter" ]; then
             echo -e "  \e[32m[PASS]\e[0m $key is set to $expected (Oracle Exception Applied)"
        else
             echo -e "  \e[32m[PASS]\e[0m $key is set to $expected"
        fi
    else
        echo -e "  \e[31m[FAIL]\e[0m $key is set to $actual (Expected: $expected)"
        FAIL_COUNT=$((FAIL_COUNT + 1))
    fi
done

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
    echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. Applying the Configuration (Remediation Bash Script)

The following script applies network changes and kernel parameters. (Note: If you are using Oracle RAC with RDS requirements, remove the line related to rds from this script).

GitHub link:

modules/remediate_14_Network_Sysctl_Parameters.sh

#!/bin/bash
# Script: remediation14.sh
# Purpose: Apply Network & Sysctl Hardening (CIS 3)

if [ "$EUID" -ne 0 ]; then 
    echo "Please run as root"
    exit 1
fi

echo "=========================================================================="
echo " Applying Remediation for CIS 3 (Network & Sysctl)"
echo " Oracle Context:"
echo " - Disabling unused protocols (dccp, tipc, rds, sctp)"
echo " - Applying sysctl network security rules."
echo " - 'rp_filter' will be set to '2' to respect Oracle Preinstall parameters."
echo "=========================================================================="

echo -e "\n[*] Applying Network & Sysctl Hardening..."

# 3.1 Disable Wireless & Bluetooth
nmcli radio all off 2>/dev/null
systemctl disable --now bluetooth.service 2>/dev/null
echo -e "  \e[32m[OK]\e[0m Disabled Wireless and Bluetooth."

# 3.2 Disable Network Kernel Modules
cat <<EOF > /etc/modprobe.d/cis_network_modules.conf
install dccp /bin/true
install tipc /bin/true
install rds /bin/true
install sctp /bin/true
EOF
echo -e "  \e[32m[OK]\e[0m Disabled uncommon network protocols (dccp, tipc, rds, sctp)."

# 3.3 Configure Network Kernel Parameters (sysctl)
# Note: rp_filter is set to 2 for Oracle compatibility
cat <<EOF > /etc/sysctl.d/60-cis-network.conf
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
EOF

sysctl --system > /dev/null 2>&1
echo -e "  \e[32m[OK]\e[0m Network sysctl parameters applied successfully."

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

In the next part, we will move on to:

Configuring and Securing Host-Based Firewall