added core/conf/sysctl.conf

1 files changed, 102 insertions, 0 deletions

diff --git a/core/conf/sysctl.conf b/core/conf/sysctl.conf
new file mode 100644
index 0000000..b74243b
--- /dev/null
+++ b/core/conf/sysctl.conf
@@ -0,0 +1,102 @@
+#
+# /etc/sysctl.conf: configuration for system variables, see sysctl.conf(5)
+#
+
+kernel.printk = 1 4 1 7
+
+# Disable ipv6
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1
+
+# Tuen IPv6
+# net.ipv6.conf.default.router_solicitations = 0
+# net.ipv6.conf.default.accept_ra_rtr_pref = 0
+# net.ipv6.conf.default.accept_ra_pinfo = 0
+# net.ipv6.conf.default.accept_ra_defrtr = 0
+# net.ipv6.conf.default.autoconf = 0
+# net.ipv6.conf.default.dad_transmits = 0
+# net.ipv6.conf.default.max_addresses = 0
+
+# Avoid a smurf attack
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+# Turn on protection for bad icmp error messages
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+# Turn on syncookies for SYN flood attack protection
+net.ipv4.tcp_syncookies = 1
+
+## protect against tcp time-wait assassination hazards
+## drop RST packets for sockets in the time-wait state
+## (not widely supported outside of linux, but conforms to RFC)
+net.ipv4.tcp_rfc1337 = 1
+
+## tcp timestamps
+## + protect against wrapping sequence numbers (at gigabit speeds)
+## + round trip time calculation implemented in TCP
+## - causes extra overhead and allows uptime detection by scanners like nmap
+## enable @ gigabit speeds
+net.ipv4.tcp_timestamps = 0
+#net.ipv4.tcp_timestamps = 1
+
+# Turn on and log spoofed, source routed, and redirect packets
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+
+## ignore echo broadcast requests to prevent being part of smurf attacks (default)
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+# No source routed packets here
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+## sets the kernels reverse path filtering mechanism to value 1(on)
+## will do source validation of the packet's recieved from all the interfaces on the machine
+## protects from attackers that are using ip spoofing methods to do harm
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv6.conf.default.rp_filter = 1
+net.ipv6.conf.all.rp_filter = 1
+
+# Make sure no one can alter the routing tables
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+net.ipv4.conf.default.secure_redirects = 0
+
+# Act as a router, necessary for Access Point
+net.ipv4.ip_forward = 1
+net.ipv4.conf.all.send_redirects = 1
+net.ipv4.conf.default.send_redirects = 1
+
+kernel.shmmax = 500000000
+# Turn on execshild
+kernel.exec-shield = 1
+kernel.randomize_va_space = 1
+
+# Optimization for port usefor LBs
+# Increase system file descriptor limit
+fs.file-max = 65535
+
+# Allow for more PIDs (to reduce rollover problems); may break some programs 32768
+kernel.pid_max = 65536
+
+# Increase system IP port limits
+net.ipv4.ip_local_port_range = 2000 65000
+
+# Increase TCP max buffer size setable using setsockopt()
+net.ipv4.tcp_rmem = 4096 87380 8388608
+net.ipv4.tcp_wmem = 4096 87380 8388608
+
+# Increase Linux auto tuning TCP buffer limits
+# min, default, and max number of bytes to use
+# set max to at least 4MB, or higher if you use very high BDP paths
+# Tcp Windows etc
+net.core.rmem_max = 8388608
+net.core.wmem_max = 8388608
+net.core.netdev_max_backlog = 5000
+net.ipv4.tcp_window_scaling = 1
+
+# End of file
+