net.ipv4.conf.default.rp_filter has 2 different values in default RHEL9 install

Solution Verified - Updated -

Issue

  • In a default installation of RHEL9, net.ipv4.conf.default.rp_filter is defined twice, (/usr/lib/sysctl.d/50-redhat.conf and 50-default.conf), with 50-default.conf setting it to 2 and 50-redhat.conf setting it to 1.

    # grep net.ipv4.conf.default.rp_filter /usr/lib/sysctl.d/*
    /usr/lib/sysctl.d/50-default.conf:net.ipv4.conf.default.rp_filter = 2
    /usr/lib/sysctl.d/50-redhat.conf:net.ipv4.conf.default.rp_filter = 1
    
  • And even with the value set to 1, the oscap scan oof CIS profile fails:

    oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --rule xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter  --results `uname -n`_scan_results.xml --report `uname -n`_scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
    --- Starting Evaluation ---
    
    Title   Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
    Rule    xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter
    Ident   CCE-84009-0
    Result  fail
    

    and

    sysctl -a |grep net.ipv4.conf.default.rp_filter
    net.ipv4.conf.default.rp_filter = 1
    

Environment

  • RHEL 9
  • openscap
  • sysctl
  • CIS

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content