3.15 Set Maximum Number of Half-open TCP Connections

Information

This setting controls how many half-open connections can exist for a TCP port.

Rationale:

It is necessary to control the number of completed connections to the system to provide some protection against Denial of Service attacks. Note that the value of 4096 is a minimum to establish a good security posture for this setting. In environments where connection numbers are high, such as a busy webserver, this value may need to be increased.

Solution

To enforce this setting, run the following command:

# ipadm set-prop -p _conn_req_max_q0=4096 tcp

See Also

https://workbench.cisecurity.org/benchmarks/4777

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: af0e416a850bb220a2b45a70790833c682a402d13eb3e4e98a42e550d68d527c