3.4.3.1 Ensure nftables is installed

Information

nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.

Note:

-

nftables is available in Linux kernel 3.13 and newer.

-

Only one firewall utility should be installed and configured.

nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Solution

Run the following command to install nftables

# yum install nftables

Impact:

Changing firewall settings while connected over the network can result in being locked out of the system.

See Also

https://workbench.cisecurity.org/benchmarks/15963

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 77c5f5dd7f78150b57900de460b94b1d70c99277e1903c83d4b31bbc3add262c