documentation_complete: true


title: 'Enable DoS Protections in SuSEfirewall2'

description: |-
    {{{ describe_package_install(package="SuSEfirewall2") }}}
    {{{ describe_service_enable(service="SuSEfirewall2") }}}

    Verify "SuSEfirewall2" is configured to protect the SUSE operating system
    against or limit the effects of DoS attacks. 

    Run the following command:

    <pre># grep -i fw_services_accept_ext /etc/sysconfig/SuSEfirewall2
    FW_SERVICES_ACCEPT_EXT="0/0,tcp,22,,hitcount=3,blockseconds=60,recentname=ssh"</pre>

    If the "FW_SERVICES_ACCEPT_EXT" rule does not contain both the
    <tt>hitcount</tt> and <tt>blockseconds</tt> parameters, this is a finding.

rationale: |-
    DoS is a condition when a resource is not available for legitimate users.
    When this occurs, the organization either cannot accomplish its mission or
    must operate at degraded capacity.

    This requirement addresses the configuration of the SUSE operating system to
    mitigate the impact on system availability of DoS attacks that have occurred
    or are ongoing. For each system, known and potential DoS attacks must be
    identified and solutions for each type implemented. A variety of
    technologies exist to limit or, in some cases, eliminate the effects of
    DoS attacks (e.g., limiting processes or establishing memory partitions).
    Employing increased capacity and bandwidth, combined with service
    redundancy, may reduce the susceptibility to some DoS attacks.

severity: medium

identifiers:
    cce@sle12: CCE-83156-0

references:
    nist@sle12: SC-5
    srg: SRG-OS-000420-GPOS-00186
    stigid@sle12: SLES-12-030040

ocil_clause: 'the DoS protection is not active'

ocil: |-
    {{{ ocil_package(package="SuSEfirewall2") }}}
    {{{ ocil_service_enabled(service="SuSEfirewall2") }}}

    Run the following command:

    <pre># grep -i fw_services_accept_ext /etc/sysconfig/SuSEfirewall2
    FW_SERVICES_ACCEPT_EXT="0/0,tcp,22,,hitcount=3,blockseconds=60,recentname=ssh"</pre>

    If the "FW_SERVICES_ACCEPT_EXT" rule does not contain both the
    <tt>hitcount</tt> and <tt>blockseconds</tt> parameters, this is a finding.
