SOCLE-CLD-SYS-047// Kernel & network (sysctl)mediumeffective runtime

Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces

Enables RFC 1337 protection against TIME_WAIT assassination by setting net.ipv4.tcp_rfc1337 to 1.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →

Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04

✓ One check, maps to 1 standard

ANSSI BP-028

R12

direct

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

RFC 1337 describes the TIME_WAIT assassination hazard: when disabled, a RST received in the TIME_WAIT state closes the socket immediately instead of waiting out the TIME_WAIT period, which can let stale or spoofed segments corrupt a new connection reusing the same socket. Enabling RFC 1337 behavior drops such RSTs and protects connection integrity.

What Pavois checks

Pavois reads the live value via kernel_parameter('net.ipv4.tcp_rfc1337'), reflecting the running kernel after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged, not what a static read of /etc/sysctl.conf might claim.

describe kernel_parameter('net.ipv4.tcp_rfc1337') do
  its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.tcp_rfc1337[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
  its('stdout') { should match(/\S/) }
end

How to verify it is applied

Run sysctl net.ipv4.tcp_rfc1337 and expect net.ipv4.tcp_rfc1337 = 1.

Inspect & investigate

Confirm with sysctl net.ipv4.tcp_rfc1337. There is no dedicated log line; TCP state behavior can be observed with ss -tan state time-wait and packet captures (tcpdump -ni any 'tcp[tcpflags] & tcp-rst != 0').

Remediation

Pavois's harden plan sets net.ipv4.tcp_rfc1337 = 1 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

key	net.ipv4.tcp_rfc1337
resource	sysctl
value	1

pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

No meaningful downside on servers or workstations, it only changes how RSTs are handled in TIME_WAIT, hardening connection integrity. Precaution: in very rare high-churn scenarios that aggressively recycle TIME_WAIT sockets, keeping these sockets the full duration uses slightly more socket memory; this is negligible for normal workloads.

Standards mapping

Standard	Reference	Type	Version	Confidence
ANSSI BP-028	R12	direct	2.0	high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references