Disable SCTP Support
Ensures the sctp (Stream Control Transmission Protocol) network protocol kernel module cannot be loaded.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SCTP (Stream Control Transmission Protocol) is a transport protocol mostly used in telecom signaling (SS7/Diameter) and rarely on general-purpose servers. Its kernel implementation has had multiple memory-safety vulnerabilities, and as a third transport alongside TCP/UDP it widens the network attack surface and can evade firewall rules written only for TCP/UDP. Disabling SCTP protects the system against exploitation of flaws in its implementation and removes an unused protocol.
What Pavois checks
Pavois uses the InSpec kernel_module('sctp') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not a static grep of /etc/modprobe.d/, so an application that opens an SCTP socket and autoloads the module is detected.
describe kernel_module('sctp') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v sctp, it should print install /bin/true. Confirm it is not loaded with lsmod | grep sctp (no output expected). modprobe --showconfig | grep sctp should show a blacklist sctp and an install sctp /bin/true line.
Inspect & investigate
Load attempts appear in the kernel ring buffer: dmesg | grep sctp or journalctl -k | grep sctp. The effective modprobe policy is shown by modprobe --showconfig | grep sctp; active SCTP sockets (which should be none) can be checked with ss -A sctp.
Remediation
pavois harden apply uses the kernel_module resource to blacklist sctp: it writes a drop-in under /etc/modprobe.d/ with blacklist sctp and install sctp /bin/true, and unloads the module if loaded. Because the protocol may already be loaded, reboot_required is true to guarantee a clean state.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | sctp |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a network protocol with a history of kernel CVEs stays loadable, widening the attack surface and potentially bypassing TCP/UDP-only firewall rules.
- Before applying, confirm no application uses SCTP, relevant chiefly to telecom signaling stacks (SS7/Diameter/SIGTRAN) and some clustering software.
- Non-disruptive on general-purpose servers and VMs.
- A reboot is required for full effect; schedule it in a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.4.2, 3.2.4, 3.2.6, 3.2.5 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.