Created
December 31, 2016 21:40
-
-
Save qntmpkts/33c8434a24336d4a87339710ecb8b208 to your computer and use it in GitHub Desktop.
Hardened /etc/sysctl.conf settings
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# IP Spoofing protection | |
net.ipv4.conf.all.rp_filter = 1 | |
net.ipv4.conf.default.rp_filter = 1 | |
# Ignore ICMP broadcast requests | |
net.ipv4.icmp_echo_ignore_broadcasts = 1 | |
# Disable source packet routing | |
net.ipv4.conf.all.accept_source_route = 0 | |
net.ipv6.conf.all.accept_source_route = 0 | |
net.ipv4.conf.default.accept_source_route = 0 | |
net.ipv6.conf.default.accept_source_route = 0 | |
# Ignore send redirects | |
net.ipv4.conf.all.send_redirects = 0 | |
net.ipv4.conf.default.send_redirects = 0 | |
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in | |
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate | |
# traffic to those sites. | |
net/ipv4/conf/default/accept_redirects=0 | |
net/ipv4/conf/all/accept_redirects=0 | |
net/ipv6/conf/default/accept_redirects=0 | |
net/ipv6/conf/all/accept_redirects=0 | |
# Do not accept IP source route packets (we are not a router) | |
net/ipv4/conf/default/accept_source_route=0 | |
net/ipv4/conf/all/accept_source_route=0 | |
net/ipv6/conf/default/accept_source_route=0 | |
net/ipv6/conf/all/accept_source_route=0 | |
# Ignore bogus ICMP errors | |
net/ipv4/icmp_echo_ignore_broadcasts=1 | |
net/ipv4/icmp_ignore_bogus_error_responses=1 | |
net/ipv4/icmp_echo_ignore_all=0 | |
# Block SYN attacks | |
net.ipv4.tcp_syncookies = 1 | |
net.ipv4.tcp_max_syn_backlog = 2048 | |
net.ipv4.tcp_synack_retries = 2 | |
net.ipv4.tcp_syn_retries = 5 | |
# Change to '1' to enable TCP/IP SYN cookies This disables TCP Window Scaling | |
# (http://lkml.org/lkml/2008/2/5/167) | |
net/ipv4/tcp_syncookies=0 | |
# Log Martians | |
net.ipv4.conf.all.log_martians = 1 | |
net.ipv4.icmp_ignore_bogus_error_responses = 1 | |
# Ignore ICMP redirects | |
net.ipv4.conf.all.accept_redirects = 0 | |
net.ipv6.conf.all.accept_redirects = 0 | |
net.ipv4.conf.default.accept_redirects = 0 | |
net.ipv6.conf.default.accept_redirects = 0 | |
# Ignore Directed pings | |
net.ipv4.icmp_echo_ignore_all = 1 | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment