Restrict access to firewall and IPsec configuration files

Description

The rules loaded at boot by ufw (/etc/ufw/*.rules), nftables (/etc/nftables.conf) and iptables-persistent (/etc/iptables/rules.v4, rules.v6), and the IPsec configuration (/etc/ipsec.conf, /etc/ipsec.d/, /etc/ipsec.secrets) must belong to root and must not be writable by other users. IPsec secrets and private keys must only be readable by root. Each check is not applicable when its files are absent.

Rationale

These files decide what reaches the host and with which keys VPN tunnels are authenticated. A writable rules file is a firewall bypass waiting for the next reboot; a readable pre-shared key or private key lets an attacker set up a rogue tunnel endpoint.

Impact

None known. Packages create these files with stricter or equal permissions.

Setting

Audit

Run stat -c '%n %U:%G %a' /etc/ufw/*.rules /etc/nftables.conf /etc/iptables/rules.v* /etc/ipsec.conf /etc/ipsec.d /etc/ipsec.d/private /etc/ipsec.secrets 2>/dev/null. Every file must be owned by root:root; ipsec.secrets at most 0600, ipsec.d/private at most 0700, nftables.conf at most 0755, the others at most 0644 (0755 for the ipsec.d directory).

Automated: every check must pass. Scanners report each check by its id.

ufw-rules

ufw rules files.

path: /etc/ufw/*.rules
owner: root
group: root
mode: '0644'

nftables-conf

nftables configuration loaded at boot.

path: /etc/nftables.conf
owner: root
group: root
mode: '0755'

iptables-rules

Rules restored by iptables-persistent.

path: /etc/iptables/rules.v*
owner: root
group: root
mode: '0644'

ipsec-conf

IPsec main configuration.

path: /etc/ipsec.conf
owner: root
group: root
mode: '0644'

ipsec-dir

IPsec configuration directory.

path: /etc/ipsec.d
owner: root
group: root
mode: '0755'

ipsec-private

IPsec private keys directory.

path: /etc/ipsec.d/private
owner: root
group: root
mode: '0700'

ipsec-secrets

IPsec pre-shared keys and private key passphrases.

path: /etc/ipsec.secrets
owner: root
group: root
mode: '0600'

Remediation

Run chown root:root on the files listed above, then chmod 600 /etc/ipsec.secrets, chmod 700 /etc/ipsec.d/private, chmod go-w on the others.

Rollback

Restore the previous owner and mode with chown and chmod.

ufw-rules

Generated from check ufw-rules: the engine writes the fix for every output, it sets the expected value and the check runs again after.

nftables-conf

Generated from check nftables-conf: the engine writes the fix for every output, it sets the expected value and the check runs again after.

iptables-rules

Generated from check iptables-rules: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipsec-conf

Generated from check ipsec-conf: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipsec-dir

Generated from check ipsec-dir: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipsec-private

Generated from check ipsec-private: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipsec-secrets

Generated from check ipsec-secrets: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-18
• ipsec.secrets(5), Debian manual pages (libreswan) Debian, vendor-doc, accessed 2026-10-18
• ufw(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle