Harden network with sysctl settings

Jumat, 27 Desember 2013

Harden network with sysctl settings

nah beberapa waktu lalu saat browsing saya sempat menemukan bacaan menarik tentang sysctl. cukup lah buat pertahanan sementara. kita coba saja ya .

1. buka terminal linux kemudian copy sysctl asli *(buat jaga-jaga
cp /etc/sysctl.conf /etc/sysctl.conf-old

2. buka file sysctl.conf dengan editor kesukaan anda . disini kita mencoba menggunakan gedit
gedit /etc/sysctl.conf
hapus semua tulisan didalamnya dan kemudian pastekan baris berikut
-------------------------------------------------------------------------------
# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1
---------------------------------------------------------
3. ketikkan sysctl -p di terminal untuk mengaktifkannya :)

sumber