openstack/ansible-hardening
Code Issues Proposed changes

V-38528: Log martian packets

Browse Source 
Implements: blueprint security-hardening

Change-Id: Icbbbcc1d51ea6fa903ff65d01ffda65e2f123030
This commit is contained in:
Major Hayden 2015-10-07 15:48:39 -05:00
parent bfcf6c7423
commit 2800ab9eb7
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/source/developer-notes/V-38528.rst Normal file
View File

@ -0,0 +1,5 @@
The Ansible task in this role will ensure that martian packets are logged to
rsyslog. Wikpedia's article on `martian packets`_ provides additional
information.
.. _martian packets: https://en.wikipedia.org/wiki/Martian_packet

11
openstack-ansible-security/tasks/kernel.yml
View File

@ -13,6 +13,17 @@
# See the License for the specific language governing permissions and # See the License for the specific language governing permissions and
# limitations under the License. # limitations under the License.
- name: V-38528 - The system must log martian packets
sysctl:
name: net.ipv4.conf.all.log_martians
value: 1
state: present
sysctl_set: yes
tags:
- kernel
- cat3
- V-38528
# This is the default in Ubuntu 14.04 # This is the default in Ubuntu 14.04
- name: V-38596 - Enable virtual address space randomization - name: V-38596 - Enable virtual address space randomization
sysctl: sysctl: