sysctl.conf Security Tweaks.

[StingRay]

I found these suggestions for help in securing a sever.
I check them against the default from PowerVps and there options lists here.
Can someone who knows what they are doing comment on this config and it's impact on a VPS, ie necessary, dumb, not needed, all good? etc.

in /etc/sysctl.conf, add
# disable packet forwarding
net.ipv4.ip_forward = 0
# enable source route verification
net.ipv4.conf.all.rp_filter = 1
# ignore broadcast pings
net.ipv4.icmp_echo_ignore_broadcasts = 1
# enable syn cookies
net.ipv4.tcp_syncookies = 1
# size of syn backlog
net.ipv4.tcp_max_syn_backlog = 512
# disable automatic defragmentation
# set max files
fs.file-max = 32768
# Enable IP spoofing protection, turn on Source Address Verification
net.ipv4.conf.all.rp_filter = 1
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
# Enable ignoring ping request
net.ipv4.icmp_echo_ignore_all = 1

[charles]

I'd suggest trying them on the commandline by putting these in a file and running

sysctl -p yourfile

What you will find is you can't change them all. Depending on what you get, that may be a good starting point for further discussion.

'sysctl -p' will reload the default set you have right now (to revert any changes).

hth
charles

[StingRay]

Thanks charles :)