enable_log_martians to false are logged about puppet-os-hardening HOT 6 CLOSED

Hi @hdep , I understand that log_martians was somewhere enabled in this system and then you used os_hardening with this hiera setting to disable it, right? As os_hardening is only touching conf.all.log_martians and conf.default.log_martians, interface settings like conf.eth0.log_martians are not changed at runtime. After a system reboot I'd say this should be fine ...
Have you rebooted this system since this change?

from puppet-os-hardening.

Hello,

Yes this is right, I think debian by default enable log_martian.
I didn't reboot any server, I'll give a try and let you know.

from puppet-os-hardening.

After a reboot I have a weird config, log_martians are enabled :

root@serveer:~# sysctl -a | grep martian
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.eth0.log_martians = 1
net.ipv4.conf.lo.log_martians = 0

After a few minutes the config is changed :

root@server:~# sysctl -a | grep martian
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.eth0.log_martians = 1
net.ipv4.conf.lo.log_martians = 0

I'm considering to avoid this issue to declare net.ipv4.conf.eth0.log_martians = 0 with another module.

from puppet-os-hardening.

Hmm ... that really looks like the system comes up with martians enabled (and therefore eth0 is also enabled), and then the sysctl settings from os_hardening disables all and default. I think the simplest solution would be to manually set net.ipv4.conf.eth0.log_martians in /etc/sysctl.conf or /etc/sysctl.d/ via a puppet rule.

from puppet-os-hardening.

@hdep What should we do with this issue? Can we close this?

from puppet-os-hardening.

I close the issue,

here is what I deployed on all my servers :

    sysctl { "net.ipv4.conf.${facts['networking']['primary']}.log_martians":
      ensure => present,
      value  => "0",
    }

Because all my servers didn't got the same interface name (eth0, bond0...)

from puppet-os-hardening.