Essential Linux Kernel Security Settings
Essential Linux Kernel Security Settings Below are some important security-related kernel settings for Linux. These can be configured in /etc/sysctl.conf or by adding files to /etc/sysctl.d/ . IPv4 Networking Settings TCP SYN Cookie Protection Protects against SYN flood attacks by enabling TCP SYN cookies. This kicks in only when net.ipv4.tcp_max_syn_backlog is reached: net.ipv4.tcp_syncookies = 1 Time-Wait Assassination Protection Drops RST packets for sockets in the TIME-WAIT state to prevent TCP time-wait assassination hazards. Although not widely supported outside Linux, this conforms to RFC standards: net.ipv4.tcp_rfc1337 = 1 TCP Timestamps Pros: Protects against sequence number wrapping at gigabit speeds and provides round-trip time calculations. Cons: Adds overhead and allows uptime detection by tools like Nmap. Enable for gigabit speeds: net.ipv4.tcp_timestamps = 0 #net.ipv4.tcp_timestamps = 1 Source Address Verification Helps prevent spoofing...