Harden Network Using SYSCTL

Linux is a pretty secure OS but if your running a server you might want to harden its security. I have done a few posts about securing your linux installation and this page will show how to configure you sysctl.conf file so that your system is less susceptible to attacks

Backup And Open Your sysctl.conf

sudo cp /etc/sysctl.conf /etc/sysctl.conf_BU sudo gedit /etc/sysctl.conf

When the file opens on screen use the following as a guide. Change any entires that are in your sysctl.conf to the following. Some of the following you may not have in your file. If they are not in your file add them. If for some reason you have problem with your system after these updates you can restore your origional sysctl.conf with "sudo cp /etc/sysctl.conf_BU /etc/sysctl.conf" and rebooting

# IP Spoofing protection net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # Ignore ICMP broadcast requests net.ipv4.icmp_echo_ignore_broadcasts = 1 # Disable source packet routing net.ipv4.conf.all.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 # Ignore send redirects net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 # Block SYN attacks net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 5 # Log Martians net.ipv4.conf.all.log_martians = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 # Ignore ICMP redirects net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 # Ignore Directed pings net.ipv4.icmp_echo_ignore_all = 1

Once you have the edits made save the file and exit the text editor.

Comit The System Changes

sudo sysctl -p