Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-07 00:42:42 -04:00
Code Issues Projects Releases Packages Wiki Activity

Simplify syntax of some network-related sysctl's

Browse source
This commit is contained in:
Raja Grewal 2024-08-16 12:46:51 +10:00
parent 4bc12b07b4
commit 23a77d4973
No known key found for this signature in database
GPG key ID: 92CA473C156B64C4
1 changed files with 10 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

30
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -275,8 +275,7 @@ net.ipv4.tcp_rfc1337=1
## https://forums.whonix.org/t/enable-reverse-path-filtering/8594 ## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
## https://seclists.org/oss-sec/2019/q4/122 ## https://seclists.org/oss-sec/2019/q4/122
## ##
net.ipv4.conf.all.rp_filter=1 net.ipv4.conf.*.rp_filter=1
net.ipv4.conf.default.rp_filter=1
## Disable ICMP redirect acceptance and redirect sending messages. ## Disable ICMP redirect acceptance and redirect sending messages.
## Prevents man-in-the-middle attacks and minimizes information disclosure. ## Prevents man-in-the-middle attacks and minimizes information disclosure.
@ -289,14 +288,10 @@ net.ipv4.conf.default.rp_filter=1
## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked ## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked
## https://github.com/Kicksecure/security-misc/pull/248 ## https://github.com/Kicksecure/security-misc/pull/248
## ##
net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.*.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0 net.ipv4.conf.*.send_redirects=0
net.ipv4.conf.all.send_redirects=0 net.ipv6.conf.*.accept_redirects=0
net.ipv4.conf.default.send_redirects=0 #net.ipv4.conf.*.secure_redirects=1
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0
#net.ipv4.conf.all.secure_redirects=1
#net.ipv4.conf.default.secure_redirects=1
## Ignore ICMP echo requests. ## Ignore ICMP echo requests.
## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks. ## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks.
@ -316,15 +311,12 @@ net.ipv4.icmp_ignore_bogus_error_responses=1
## ##
## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing ## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing
## ##
net.ipv4.conf.all.accept_source_route=0 net.ipv4.conf.*.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0 net.ipv6.conf.*.accept_source_route=0
net.ipv6.conf.all.accept_source_route=0
net.ipv6.conf.default.accept_source_route=0
## Do not accept IPv6 router advertisements and solicitations. ## Do not accept IPv6 router advertisements and solicitations.
## ##
net.ipv6.conf.all.accept_ra=0 net.ipv6.conf.*.accept_ra=0
net.ipv6.conf.default.accept_ra=0
## Disable SACK and DSACK. ## Disable SACK and DSACK.
## Select acknowledgements (SACKs) are a known common vector of exploitation. ## Select acknowledgements (SACKs) are a known common vector of exploitation.
@ -362,8 +354,7 @@ net.ipv4.tcp_timestamps=0
## ##
## The logging of martian packets is currently disabled. ## The logging of martian packets is currently disabled.
## ##
#net.ipv4.conf.all.log_martians=1 #net.ipv4.conf.*.log_martians=1
#net.ipv4.conf.default.log_martians=1
## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses. ## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses.
## The temporary/privacy address is used as the source for all outgoing traffic. ## The temporary/privacy address is used as the source for all outgoing traffic.
@ -379,5 +370,4 @@ net.ipv4.tcp_timestamps=0
## ##
## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. ## The use of IPv6 Privacy Extensions is currently disabled due to these breakages.
## ##
#net.ipv6.conf.all.use_tempaddr=2 #net.ipv6.conf.*.use_tempaddr=2
#net.ipv6.conf.default.use_tempaddr=2