Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-03 12:24:50 -04:00
Code Issues Projects Releases Packages Wiki Activity

Provide option to deny sending and receiving shared media redirects

Browse source
This commit is contained in:
raja-grewal 2024-11-13 05:42:56 +00:00 • committed by GitHub
parent 18aec201bf
commit 141b84c40d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -102,6 +102,9 @@ Networking:
- Disable ICMP redirect acceptance and redirect sending messages to prevent - Disable ICMP redirect acceptance and redirect sending messages to prevent
man-in-the-middle attacks and minimize information disclosure. man-in-the-middle attacks and minimize information disclosure.
- Optional - Deny sending and receiving shared media redirects to reduce
the risk of IP spoofing attacks.
- Optional - Enable ARP filtering to mitigate some ARP spoofing and ARP - Optional - Enable ARP filtering to mitigate some ARP spoofing and ARP
cache poisoning attacks. cache poisoning attacks.

11
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -443,6 +443,17 @@ net.ipv4.conf.*.send_redirects=0
net.ipv6.conf.*.accept_redirects=0 net.ipv6.conf.*.accept_redirects=0
#net.ipv4.conf.*.secure_redirects=1 #net.ipv4.conf.*.secure_redirects=1
## Deny sending and receiving RFC1620 shared media redirects.
## Relevant mainly for network interfaces that operate over shared media such as Ethernet hubs.
## Stops the kernel from sending ICMP redirects to specific networks from the connected network.
## This variable overrides the use secure_redirects.
##
## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf
## https://datatracker.ietf.org/doc/html/rfc1620
## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html
##
#net.ipv4.conf.*.shared_media=0
## Enable ARP (Address Resolution Protocol) filtering. ## Enable ARP (Address Resolution Protocol) filtering.
## Prevents the Linux kernel from handling the ARP table globally ## Prevents the Linux kernel from handling the ARP table globally
## Can mitigate some ARP spoofing and ARP cache poisoning attacks. ## Can mitigate some ARP spoofing and ARP cache poisoning attacks.