1

I’ve only been Linux for about eight months now. I mostly have my head around what’s going on but please when you answer assume I’m far from an expert.

I have been attempting to write a lockdown script that can be run after Ubuntu 20.04.x Server LTS has been initially installed. Everything so far has been working great until this.

I have been using the document CIS_Ubuntu_Linux_20.04.pdf.

This is the CIS Ubuntu Linux 20.04 LTS Benchmark v1.0.0 - 07-21-2020 written by the Center for Internet Security. https://www.cisecurity.org/cis-benchmarks/

In this document note section 3.5.1.4, I quote:

“Ensure loopback traffic is configured (Automated)

Description:

Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6).

Rationale:

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.”

It then goes on to say and I quote:

“Remediation:

Run the following commands to implement the loopback rules:

ufw allow in on lo
 
ufw allow out from lo
 
ufw deny in from 127.0.0.0/8
 
ufw deny in from ::1

Noting that I have tried with sudo, and I do understand that ufw is a front for iptables etc, but only the following command from above fails:

ufw allow out from lo 

With the error ’ERROR: Bad source address’.

I know ‘lo’ refers to the loopback address.

What am I doing wrong or is there a syntax error here?

0

1 Answer 1

2

Your tutorial has an error.

From man page:

ufw [--dry-run] [rule] [delete] [insert NUM] allow|deny|reject|limit [in|out[on INTERFACE]] [log|log-all] [proto PROTOCOL] [from ADDRESS[port PORT | app APPNAME ]] [to ADDRESS [port PORT | app APPNAME ]] [comment COMMENT]

Use:

ufw allow out on lo
1
  • 1
    For note this wasn't a tutorial, it was the CIS Ubuntu Linux 20.04 LTS Benchmark v1.0.0 - 07-21-2020 written by the Center for Internet Security. cisecurity.org/cis-benchmarks Aug 22, 2021 at 23:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .