STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

A firewall must be able to protect against or limit the effects of denial-of-service (DoS) attacks by ensuring OL 8 can implement rate-limiting measures on impacted network interfaces.

DISA Rule

SV-248865r958528_rule

Vulnerability Number

V-248865

Group Title

SRG-OS-000142-GPOS-00071

Rule Version

OL08-00-040150

Severity

CAT II

CCI(s)

CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
CCI-002322 - Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.
CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

Fix Recommendation

Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "/etc/firewalld/firewalld.conf":

FirewallBackend=nftables

Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.

Check Contents

Verify "nftables" is configured to allow rate limits on any connection to the system with the following command.

Verify "firewalld" has "nftables" set as the default backend:

$ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf

# FirewallBackend
FirewallBackend=nftables

If the "nftables" is not set as the "firewallbackend" default, this is a finding.

Vulnerability Number

V-248865

Documentable

False

Rule Version

OL08-00-040150

Severity Override Guidance

Check Content Reference

Target Key

5416