Sysctl.conf Security Knobs

Sysctl.conf Security Knobs

Add the following statements to the /etc/sysctl.conf file. You can drop the comments, but I always find them helpful later when I am looking for a problem.

3. The sysctl.conf file contains MIB's to change the default setting
4. of internal options of the kernel at boot up time. These MIB's
5. control how network packets are handled after the IPFW or IPFILTER
6. software application firewalls return the packet to the kernel.
7. Some of these MIB's may seem like they are doing the same thing,
8. but because there is no FBSD provided documentation on the order
9. these MIB's get control, they all get enabled here and we let the
10. kernel do its thing.
12. NOTE: Some of these MIB's can also be set in rc.conf and/or the
13. kernel source. This will not hurt anything.

2. Redirect attacks are the purposeful mass issuing of ICMP type 5 packets.
3. In a normal network, redirects to the end stations should not be required.
4. To defend against this type of attack both the sending and accepting of
5. redirect should be disabled. The first statement below enables the MIB
6. to drop all inbound icmp redirect packets without returning any response.
7. The second statement turns off the logging of redirect packets because
8. there in no limit and this could fill up your logs consuming your whole
9. hard drive. But there is no information about where the redirect packets
10. get logged. The last statement changes the FBSD default about allowing
11. redirects to be sent from this system to the Internet from yes to no.
12. This option is ignored unless the host is routing IP packets, and
13. should normally be enabled (=1) on all systems
14. man icmp(4) and inet(4) and man ip(4) do not contain info about these MIBs.
15. man sysctl(3) does have info on ip.redirect

net.inet.icmp.drop_redirect=1 net.inet.icmp.log_redirect=0 net.inet.ip.redirect=0

2. Source routing is another way for an attacker to try to reach non-routable
3. addresses behind your box. It can also be used to probe for information
4. about your internal networks. These functions come enabled as part of the
5. standard FBSD core system. The following will disable them.
6. man inet(4) and man ip(4) do not contain any information on these MIBs.

net.inet.ip.sourceroute=0 net.inet.ip.accept_sourceroute=0

2. This MIB only drops ICMP echo requests which have a destination of your
3. broadcast address. For example, if your network is 10.10.0.1/24,
4. (making your subnet mask 255.255.255.0) then your network broadcast address
5. is 10.10.0.255. When a host on your network needs to send a message to all
6. other hosts on the subnet (which happens more often than you may think) it
7. uses this address. Everyone listens on it. Hosts outside your network have
8. no reason to be sending packets to your broadcast address. This MIB rejects
9. all of the broadcast echo traffic from the outside world to your network
10. broadcast address. If this host is a firewall or gateway, it should not
11. propagate directed broadcasts originating from outside your private network.
12. The following statement sets the default to no, rejecting all external
13. broadcasts requests.
14. man sysctl(3) has some info.
15. man inet(4) and man icmp(4) do not contain any information on these MIBs.

net.inet.icmp.bmcastecho=0

2. This changes the system behavior when connection requests are received
3. on TCP or UDP ports where there is no socket listening. The normal
4. behavior, when a TCP SYN segment is received on a port where there
5. is no socket accepting connections is for the system to return a
6. RST segment and drop the connection. The requesting system will
7. see this as a "Connection reset by peer".
9. By turning the TCP black hole MIB on with a numeric value of one, the
10. incoming SYN segment is merely dropped, and no RST is sent, making
11. the system appear as a blackhole.
13. By setting the MIB value to two, any segment arriving on a closed
14. port is dropped without returning a RST.
15. This provides some degree of protection against stealth port scans.
16. The following enables this MIB. man tcp(4) and man udp(4) blackhole(4)
17. contain a little information on these MIBs.

net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1

2. The log_in_vain MIB will provide you with logging of attempted
3. connections to your box on any port which does not have a service
4. running on it. For example, if you do not have DNS server on your
5. computer and someone would try to access your computer through DNS
6. port 53, you would see a message such as: Connection attempt to
7. UDP yourIP:53 from otherIP:X (where X is some high port #) displayed
8. on the root console screen. This message also gets posted to
9. /var/log/messages & /var/log/security.log.
10. The following statements enable this function.
11. man tcp(4) and man udp(4) contain a little information on these MIBs.

net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1

2. To defend against SYN attacks more commonly known as SYNFLOOD attacks,
3. the two queues which are targeted by this type of attack should
4. have their size increased so that the queues can withstand an attack
5. of low to moderate intensity with little to no effect on the stability
6. or availability of the system. FBSD maintains separate queues for
7. inbound socket connection requests. One queue is for half-open sockets
8. (SYN received, SYN|ACK sent), and the other queue for fully-open sockets
9. awaiting an accept() call from the application.
10. The following statement increases the queue size from 128.

kern.ipc.somaxconn=1024 

2. By allowing aged ARP entries to remain cached or lying around
3. allows for the possibility of a hacker to create a resource
4. exhaustion or performance degradation by filling the IP route cache
5. with bogus ARP entries. This in turn can be used as a Denial of
6. Service attack. To prevent this sort of problem, the following
7. statement shortens the amount of time an ARP will be cached
8. from 1200 to 600 seconds.

net.link.ether.inet.max_age=600