Description
nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The nftables package can be installed with the following command:
$ apt-get install nftables
Rationale
nftables is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.
Shell script
The following script can be run on the host to remediate the issue.
DEBIAN\_FRONTEND=noninteractive apt-get install -y "nftables"
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Ensure nftables is installed
package:
name: nftables
state: present
tags:
- enable\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- package\_nftables\_installed
