Adjustment of Network Security Options

/Proc/sys network security option Adjustment
· Making the system unresponsive to ping
· Making the system unresponsive to broadcast
· Cancel IP source routing
· Enable tcp syn Cookie Protection
· Cancel ICMP acceptance of Redirect
· Enable error message protection
· Enable IP Spoofing Protection
· Record Spoofed Packets, Source Routed Packets, and Redirect Packets
Redhat 6.1 practices:

[root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all[root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts[root@deep /]# for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do> echo 0 > $f> done[root@deep /]# echo 1 > /proc/sys/net/ipv4/tcp_syncookies[root@deep /]# for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do> echo 0 > $f> done[root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses[root@deep /]# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do> echo 0 > $f> done[root@deep /]# for f in /proc/sys/net/ipv4/conf/*/log_martians; do> echo 0 > $f> done

Redhat 6.2 practices:

# Enable ignoring ping requestnet.ipv4.icmp_echo_ignore_all = 1# Enable ignoring broadcasts requestnet.ipv4.icmp_echo_ignore_broadcasts = 1# Disables IP source routingnet.ipv4.conf.all.accept_source_route = 0# Enable TCP SYN Cookie Protectionnet.ipv4.tcp_syncookies = 1# Disable ICMP Redirect Acceptancenet.ipv4.conf.all.accept_redirects = 0# Enable bad error message Protectionnet.ipv4.icmp_ignore_bogus_error_responses = 1# Enable IP spoofing protection, turn on Source Address Verificationnet.ipv4.conf.all.rp_filter = 1# Log Spoofed Packets, Source Routed Packets, Redirect Packetsnet.ipv4.conf.all.log_martians = 1

Last reactivate

[root@deep /]# /etc/rc.d/init.d/network restart

Related Articles]

• Linux network security skills

• Linux network security experience

• Limitations on Linux Network Security