Adjustment of Network Security Options

Article Title: Adjustment of Network Security Options. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
/Proc/sys network security option Adjustment
· Making the system unresponsive to ping
· Making the system unresponsive to broadcast
· Cancel IP source routing
· Enable tcp syn Cookie Protection
· Cancel ICMP acceptance of Redirect
· Enable error message protection
· Enable IP Spoofing Protection
· Record Spoofed Packets, Source Routed Packets, and Redirect Packets
Redhat 6.1 practices:
[Root @ deep/] # echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_all
[Root @ deep/] # echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
[Root @ deep/] # for f in/proc/sys/net/ipv4/conf/*/accept_source_route; do
> Echo 0> $ f
> Done
[Root @ deep/] # echo 1>/proc/sys/net/ipv4/tcp_syncookies
[Root @ deep/] # for f in/proc/sys/net/ipv4/conf/*/accept_redirects; do
> Echo 0> $ f
> Done
[Root @ deep/] # echo 1>/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
[Root @ deep/] # for f in/proc/sys/net/ipv4/conf/*/rp_filter; do
> Echo 0> $ f
> Done
[Root @ deep/] # for f in/proc/sys/net/ipv4/conf/*/log_martians; do
> Echo 0> $ f
> Done
　　
Redhat 6.2 practices:
Edit the "/etc/sysctl. conf" file and add the following lines,
# Enable ignoring ping request
Net. ipv4.icmp _ echo_ignore_all = 1
# Enable ignoring broadcasts request
Net. ipv4.icmp _ echo_ignore_broadcasts = 1
# Disables IP source routing
Net. ipv4.conf. all. accept_source_route = 0
# Enable tcp syn Cookie Protection
Net. ipv4.tcp _ syncookies = 1
# Disable ICMP Redirect Acceptance
Net. ipv4.conf. all. accept_redirects = 0
# Enable bad error message Protection
Net. ipv4.icmp _ ignore_bogus_error_responses = 1
# Enable IP spoofing protection, turn on Source Address Verification
Net. ipv4.conf. all. rp_filter = 1
# Log Spoofed Packets, Source Routed Packets, Redirect Packets
Net. ipv4.conf. all. log_martians = 1
Finally, reactivate the network.
[Root @ deep/] #/etc/rc. d/init. d/network restart