Securizando el OS, sysctl.conf y la pila TCP en Kernel

Recomendaciones para asegurar nuestro servidor Linux con parámetros a nivel Kernel en entorno de red.

Fichero /etc/sysctl.conf

sysctl fs.suid_dumpable=0
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_syn_retries=2
net.ipv4.tcp_synack_retries=2
net.ipv4.tcp_max_syn_backlog=4096
net.ipv4.conf.all.proxy_arp=0
net.ipv4.conf.all.arp_ignore=1
net.ipv4.conf.all.arp_announce=2
net.ipv4.tcp_rfc1337=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
fs.protected_hardlinks = 0
fs.protected_symlinks = 0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Aplicamos cambios sin reiniciar:

sysctl --system

Otras configuraciones:

https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening

https://www.kmotoko.com/articles/linux-hardening-kernel-parameters-with-sysctl