#
# /etc/sysctl.d/10-hardening.conf - Configuration file
# for hardening system variables as recommended by Lynis.
#
# Settings can be overridden in /etc/sysctl.conf.
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#
##############################################################3
# Harden kernel recommendations by Lynis
fs.suid_dumpable = 0
kernel.core_uses_pid = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.sysrq = 0


##############################################################3
# Functions previously found in netbase
#

# Enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1

# Enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
net.ipv4.tcp_syncookies = 1

# Enable packet forwarding for IPv4
net.ipv4.conf.all.forwarding = 0

# Enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding = 0


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
#
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
# Set 'default' key too - see https://unix.stackexchange.com/a/90560/60506
net.ipv4.conf.default.send_redirects = 0
# Deprecated option for ipv6
#net.ipv6.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
#
# Disable TCP timestamps
net.ipv4.tcp_timestamps = 0
#
