documentation_complete: true


title: 'ufw Must rate-limit network interfaces'

description: |-
    The operating system must configure the uncomplicated firewall to
    rate-limit impacted network interfaces.

    Check all the services listening to the ports with the following
    command:
    <pre>$ sudo ss -l46ut
    Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
    tcp LISTEN 0 128 [::]:ssh [::]:*</pre>

    For each entry, verify that the ufw is configured to rate limit the
    service ports with the following command:
    <pre>$ sudo ufw status</pre>

    If any port with a state of "LISTEN" is not marked with the "LIMIT"
    action, run the following command, replacing "service" with the
    service that needs to be rate limited:
    <pre>$ sudo ufw limit "service"</pre>

    Rate-limiting can also be done on an interface. An example of adding
    a rate-limit on the eth0 interface follows:
    <pre>$ sudo ufw limit in on eth0</pre>

rationale: |-
    This requirement addresses the configuration of the operating system to
    mitigate the impact of DoS attacks that have occurred or are ongoing on
    system availability. For each system, known and potential DoS attacks
    must be identified and solutions for each type implemented. A variety
    of technologies exist to limit or, in some cases, eliminate the effects
    of DoS attacks (e.g., limiting processes or establishing memory
    partitions). Employing increased capacity and bandwidth, combined with
    service redundancy, may reduce the susceptibility to some DoS attacks.

severity: medium

references:
    srg: SRG-OS-000420-GPOS-00186

ocil_clause: 'network interface not rate-limit'

ocil: |-
    Check all the services listening to the ports with the following
    command:
    <pre>$ sudo ss -l46ut
    Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
    tcp LISTEN 0 128 [::]:ssh [::]:*</pre>

    For each entry, verify that the ufw is configured to rate limit the
    service ports with the following command:
    <pre>$ sudo ufw status</pre>

    If any port with a state of "LISTEN" is not marked with the "LIMIT"
    action, run the following command, replacing "service" with the
    service that needs to be rate limited:
    <pre>$ sudo ufw limit "service"</pre>

    Rate-limiting can also be done on an interface. An example of adding
    a rate-limit on the eth0 interface follows:
    <pre>$ sudo ufw limit in on eth0</pre>
