You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 lines
2.5 KiB
45 lines
2.5 KiB
#
|
|
# Configuration file for setting network variables. Please note these settings
|
|
# override /etc/sysctl.conf and /etc/sysctl.d. If you prefer to use
|
|
# /etc/sysctl.conf, please adjust IPT_SYSCTL in /etc/default/ufw. See
|
|
# Documentation/networking/ip-sysctl.txt in the kernel source code for more
|
|
# information.
|
|
#
|
|
|
|
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
|
|
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
|
|
# traffic to those sites.
|
|
net/ipv4/conf/all/accept_redirects=0
|
|
net/ipv4/conf/default/accept_redirects=0
|
|
net/ipv6/conf/all/accept_redirects=0
|
|
net/ipv6/conf/default/accept_redirects=0
|
|
|
|
# Ignore bogus ICMP errors
|
|
net/ipv4/icmp_echo_ignore_broadcasts=1
|
|
net/ipv4/icmp_ignore_bogus_error_responses=1
|
|
net/ipv4/icmp_echo_ignore_all=0
|
|
|
|
# Don't log Martian Packets (impossible addresses)
|
|
# packets
|
|
net/ipv4/conf/all/log_martians=0
|
|
net/ipv4/conf/default/log_martians=0
|
|
|
|
net/ipv4/tcp/syncookies=1 # Enable syn flood protection
|
|
net/ipv4/conf/all/accept_source_route=0 # Ignore source-routed packets
|
|
net/ipv6/conf/all/accept_source_route=0 # IPv6 - Ignore ICMP redirects
|
|
net/ipv4/conf/default/accept_source_route=0 # Ignore source-routed packets
|
|
net/ipv6/conf/default/accept_source_route=0 # IPv6 - Ignore source-routed packets
|
|
net/ipv4/conf/all/secure_redirects=1 # Ignore ICMP redirects from non-GW hosts
|
|
net/ipv4/conf/default/secure_redirects=1 # Ignore ICMP redirects from non-GW hosts
|
|
net/ipv4/ip_forward=0 # Do not allow traffic between networks or act as a router
|
|
net/ipv6/conf/all/forwarding=0 # IPv6 - Do not allow traffic between networks or act as a router
|
|
net/ipv4/conf/all/send_redirects=0 # Don't allow traffic between networks or act as a router
|
|
net/ipv4/conf/default/send_redirects=0 # Don't allow traffic between networks or act as a router
|
|
net/ipv4/conf/all/rp_filter=1 # Reverse path filtering - IP spoofing protection
|
|
net/ipv4/conf/default/rp_filter=1 # Reverse path filtering - IP spoofing protection
|
|
net/ipv4/tcp_rfc1337=1 # Implement RFC 1337 fix
|
|
kernel/randomize_va_space=2 # Randomize addresses of mmap base, heap, stack and VDSO page
|
|
fs/protected_hardlinks=1 # Provide protection from ToCToU races
|
|
fs/protected_symlinks=1 # Provide protection from ToCToU races
|
|
kernel/kptr_restrict=1 # Make locating kernel addresses more difficult
|
|
kernel/perf_event_paranoid=2 # Set perf only available to root
|
|
|