Pensamientos al azar acerca de BMW FAQ Club
Tweaking and hardening sysctl.conf
Escrito 29-may-2009 a las 10:20 por Danny
The principal purpouse of hardening sysctl.com is not allow DoS attacks and spoofing.
A real Distributed Denial of Service (DDoS) only can be stopped with expensive hardware. This hardening is a little prevention to buffer overflow with Apache MaxClients.
Please complete this setup together a dynamic firewall like APF http://www.rfxnetworks.com/apf.php
The main interface in my server are eth1 please change eth1 by eth0 or whatever you want.
A real Distributed Denial of Service (DDoS) only can be stopped with expensive hardware. This hardening is a little prevention to buffer overflow with Apache MaxClients.
Please complete this setup together a dynamic firewall like APF http://www.rfxnetworks.com/apf.php
The main interface in my server are eth1 please change eth1 by eth0 or whatever you want.
Código:
#Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. net.ipv4.ip_forward=0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.lo.accept_source_route = 0 net.ipv4.conf.eth1.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv4.conf.eth1.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.log_martians = 0 net.ipv4.conf.lo.log_martians = 0 net.ipv4.conf.eth1.log_martians = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.lo.accept_source_route = 0 net.ipv4.conf.eth1.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv4.conf.eth1.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 kernel.sysrq = 0 net.ipv4.tcp_fin_timeout = 15 net.ipv4.tcp_keepalive_time = 1800 net.ipv4.tcp_window_scaling = 0 net.ipv4.tcp_sack = 0 net.ipv4.tcp_timestamps = 0 net.ipv4.tcp_syncookies = 1 net.ipv4.icmp_echo_ignore_broadcasts = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 net.ipv4.conf.all.log_martians = 1 net.ipv4.tcp_max_syn_backlog = 1024 net.ipv4.tcp_max_tw_buckets = 1440000 net.ipv4.ip_local_port_range = 16384 65536
Total de Comentarios 0
