24 lines
791 B
Text
24 lines
791 B
Text
# CNSPEC: Ensure suspicious packets are logged
|
|
net.ipv4.conf.all.log_martians = 1
|
|
net.ipv4.conf.default.log_martians = 1
|
|
|
|
# CNSPEC: Ensure Reverse Path Filtering is enabled
|
|
net.ipv4.conf.all.rp_filter = 1
|
|
net.ipv4.conf.default.rp_filter = 1
|
|
|
|
# CNSPEC: Ensure core dumps are restricted
|
|
fs.suid_dumpable = 0
|
|
|
|
# CNSPEC: Ensure ICMP redirects are not accepted
|
|
net.ipv4.conf.all.accept_redirects = 0
|
|
net.ipv4.conf.default.accept_redirects = 0
|
|
net.ipv6.conf.all.accept_redirects = 0
|
|
net.ipv6.conf.default.accept_redirects = 0
|
|
|
|
# CNSPEC: Ensure secure ICMP redirects are not accepted
|
|
net.ipv4.conf.all.secure_redirects = 0
|
|
net.ipv4.conf.default.secure_redirects = 0
|
|
|
|
# CNSPEC: Ensure packet redirect sending is disabled
|
|
net.ipv4.conf.all.send_redirects = 0
|
|
net.ipv4.conf.default.send_redirects = 0
|