ConfigServer Community Forum

Hi,

I am using CSF on my cpanel server, i want to disable ICMP Timestamp Response as Trustwave is failing PCI DSS scan due to this, how do I achieve this via CSF, I disabled incoming ICMP but that has not solved this issue. Below is the description given by Trustwave about this:

---
The ICMP protocol is used to support many administrative and maintenance messages on an IP network (the most commonly known utility that uses ICMP is "ping"). This system responded to an ICMP Timestamp request. An attacker could use the returned information (the time set on the target machine) in preparation for certain time-based attacks.
---

And remedition:

---
As a general rule, ICMP should be blocked at the perimeter of your network. This protocol has been used in numerous covert command and control channels employed by trojan horses and can also be used for general network reconnaissance; therefore, it should not be allowed into your network. The best place to filter this traffic is at a perimeter router via an access control list (ACL); however, you can also do this via firewall rulesets.
---

Please help.

Thanks.

I was looking for a similar solution and this is how I came across this thread. I'm taking it you never found a way to do this in CSF. I don't think CSF supports blocking ICMP time-stamp requests and replies. What operating system are you running? I'm running CentOS 7.3.1611 (Core). The way I blocked ICMP timestamp requests and replies was this way:

I created the file /etc/csf/csfpost.sh with file permissions 700 and added some lines for the iptables firewall:

root@franklin:[/]# nano -w /etc/csf/csfpost.sh

# Block ICMP Time Stamps to make it harder for attackers to find out how long the server's been running
echo -e "Blocking ICMP Timestamp replies and requests..."
/usr/sbin/iptables -A INPUT ! -i lo -p icmp -m icmp --icmp-type timestamp-request -j DROP
/usr/sbin/iptables -A OUTPUT ! -o lo -p icmp -m icmp --icmp-type timestamp-reply -j DROP

Then I save with CTRL-X and change the file permissions to 0700:
root@franklin:[/]# chmod 0700 /etc/csf/csfpost.sh

Finally, I restart csf and lfd:
root@franklin:[/]# /usr/sbin/csf -ra

Personally, I would love to see CSF implement the blocking of ICMP timestamp requests and blocks via the csf.conf file. I can't really think of a reason why they don't block them, but block the other ICMP type traffic via a config option.

I hope this helps!