Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-04-16 01:53:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

Simplify syntax of some network-related sysctl's

Browse Source
This commit is contained in:
Raja Grewal 2024-08-16 12:46:51 +10:00
parent 4bc12b07b4
commit 23a77d4973
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
1 changed files with 10 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -275,8 +275,7 @@ net.ipv4.tcp_rfc1337=1
## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
## https://seclists.org/oss-sec/2019/q4/122
##
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.*.rp_filter=1
## Disable ICMP redirect acceptance and redirect sending messages.
## Prevents man-in-the-middle attacks and minimizes information disclosure.
@ -289,14 +288,10 @@ net.ipv4.conf.default.rp_filter=1
## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked
## https://github.com/Kicksecure/security-misc/pull/248
##
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0
#net.ipv4.conf.all.secure_redirects=1
#net.ipv4.conf.default.secure_redirects=1
net.ipv4.conf.*.accept_redirects=0
net.ipv4.conf.*.send_redirects=0
net.ipv6.conf.*.accept_redirects=0
#net.ipv4.conf.*.secure_redirects=1
## Ignore ICMP echo requests.
## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks.
@ -316,15 +311,12 @@ net.ipv4.icmp_ignore_bogus_error_responses=1
##
## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing
##
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0
net.ipv6.conf.all.accept_source_route=0
net.ipv6.conf.default.accept_source_route=0
net.ipv4.conf.*.accept_source_route=0
net.ipv6.conf.*.accept_source_route=0
## Do not accept IPv6 router advertisements and solicitations.
##
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.*.accept_ra=0
## Disable SACK and DSACK.
## Select acknowledgements (SACKs) are a known common vector of exploitation.
@ -362,8 +354,7 @@ net.ipv4.tcp_timestamps=0
##
## The logging of martian packets is currently disabled.
##
#net.ipv4.conf.all.log_martians=1
#net.ipv4.conf.default.log_martians=1
#net.ipv4.conf.*.log_martians=1
## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses.
## The temporary/privacy address is used as the source for all outgoing traffic.
@ -379,5 +370,4 @@ net.ipv4.tcp_timestamps=0
##
## The use of IPv6 Privacy Extensions is currently disabled due to these breakages.
##
#net.ipv6.conf.all.use_tempaddr=2
#net.ipv6.conf.default.use_tempaddr=2
#net.ipv6.conf.*.use_tempaddr=2