Linux Kernel /etc/sysctl.conf Security Hardening

by

The /etc/sysctl.conf file is used to configure various system parameters on Linux systems, including security-related settings. Here are some steps you can take to harden your Linux kernel by editing the /etc/sysctl.conf file:

  1. Open the /etc/sysctl.conf file with your preferred text editor.
sudo nano /etc/sysctl.conf
  1. Set the following parameters to restrict access to the /proc filesystem:
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2

The kernel.dmesg_restrict parameter restricts access to the kernel message buffer, and the kernel.kptr_restrict parameter prevents the kernel’s internal pointers from being exposed to non-privileged users.

  1. Set the following parameters to prevent IP spoofing and to enable TCP SYN cookies:
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1

The net.ipv4.conf.all.rp_filter and net.ipv4.conf.default.rp_filter parameters enable reverse path filtering, which helps prevent IP spoofing. The net.ipv4.tcp_syncookies parameter enables TCP SYN cookies, which can help prevent certain types of denial-of-service attacks.

  1. Set the following parameters to limit the number of concurrent connections and to prevent SYN flooding:
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1

The net.ipv4.tcp_max_syn_backlog parameter limits the number of outstanding SYN requests that can be pending at any given time. The net.ipv4.tcp_synack_retries and net.ipv4.tcp_syn_retries parameters limit the number of times a TCP connection request can be retried. The net.ipv4.tcp_tw_recycle and net.ipv4.tcp_tw_reuse parameters allow the reuse of TIME_WAIT sockets to prevent SYN flooding.

  1. Save and close the file.
  2. Apply the new settings by running the following command:
sudo sysctl -p

These are just a few examples of the many parameters you can set in the /etc/sysctl.conf file to harden your Linux kernel. Be sure to read the documentation and choose the parameters that are appropriate for your system and use case.

Leave a Comment