Centos8漏扫 ICMP timestamp请求响应漏洞&允许Traceroute探测 的解决方法

ICMP timestamp请求响应漏洞

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type timestamp-request -m comment --comment "deny ICMP timestamp" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type timestamp-reply -m comment --comment "deny ICMP timestamp" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type 11 -m comment --comment "time-exceeded" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 11 -m comment --comment "time-exceeded" -j DROP

允许Traceroute探测

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type 0 -m comment --comment "echo-reply" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 0 -m comment --comment "echo-reply" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type 3 -m comment --comment "destination-unreachable" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 3 -m comment --comment "destination-unreachable" -j DROP

--reload使之生效

firewall-cmd --reload

--get-all-rules查看添加的规则

firewall-cmd --direct --get-all-rules

由于添加 echo-reply规则导致ping不通，现需要移除规则--remove-rule

firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 -p ICMP --icmp-type 0 -m comment --comment "echo-reply" -j DROP
firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 0 -m comment --comment "echo-reply" -j DROP