KERNEL HARDENING

put this kernel load modules in:
sudo nano /etc/sysctl.conf

1- Anti-DDoS Kernel Settings (sysctl.conf)
SERVER KERNEL HARDENING

SOURCE: https://javapipe.com/blog/iptables-ddos-protection/

kernel.printk = 4 4 1 7
kernel.panic = 10
kernel.sysrq = 0
kernel.shmmax = 4294967296
kernel.shmall = 4194304
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5
fs.file-max = 2097152
net.core.netdev_max_backlog = 262144
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864
net.core.somaxconn = 65535
net.core.optmem_max = 25165824
net.ipv4.neigh.default.gc_thresh1 = 4096
net.ipv4.neigh.default.gc_thresh2 = 8192
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv4.neigh.default.gc_interval = 5
net.ipv4.neigh.default.gc_stale_time = 120
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.route.flush = 1
net.ipv4.route.max_size = 8048576
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 4096 87380 33554432
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 400000
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1

And this is for:

2- SERVER / HOST / CLIENT PC - KERNEL HARDENING - General Purpose

ANSSI-BP-028 >>> French Governement CiberSecurity Agency

SOURCE: https://www.ssi.gouv.fr/guide/configuration-recommendations-of-a-gnulinux-system/

This is for HOST/Client PC NO ROUTER, « server » that does not perform routing

No routing between interfaces

net.ipv4.ip_forward = 0

Reverse path filtering

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

Do not send ICMP redirects

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

Deny source routing packets

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

Do not accept ICMPs of redirect type

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

Log packets with abnormal IPs

net.ipv4.conf.all.log_martians = 1

RFC 1337

net.ipv4.tcp_rfc1337 = 1

Ignore responses that do not comply with RFC 1122

net.ipv4. icmp_ignore_bogus_error_responses = 1

Increase the range for ephemeral ports

net.ipv4.ip_local_port_range = 32768 65535

Use SYN cookies

net.ipv4.tcp_syncookies = 1

Disable support for "router solicitations"

net.ipv6.conf.all.router_solicitations = 0
net.ipv6.conf.default.router_solicitations = 0

Do not accept "router preferences" by "router advertisements "

net.ipv6.conf.all.accept_ra_rtr_pref = 0
net.ipv6.conf.default.accept_ra_rtr_pref = 0

No auto configuration of prefixes by router advertisements

net.ipv6.conf.all.accept_ra_pinfo = 0
net.ipv6.conf.default.accept_ra_pinfo = 0

No default router learning by router advertisements

net.ipv6.conf.all.accept_ra_defrtr = 0
net.ipv6.conf.default.accept_ra_defrtr = 0

No auto configuration of addresses from "routers advertisements "

net.ipv6.conf.all.autoconf = 0
net.ipv6.conf.default.autoconf = 0

Do not accept ICMPs of redirect type

net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

Deny routing source packets

net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

Maximum number of autoconfigured addresses per interface

net.ipv6.conf.all.max_addresses = 1
net.ipv6.conf.default.max_addresses = 1

Disabling SysReq

kernel.sysrq = 0

No core dump of executable setuid

fs.suid_dumpable = 0

Prohibit unreferencing links to files

the current user is not the owner

Can prevent some programs from working properly

fs. protected_symlinks = 1
fs. protected_hardlinks = 1

Activation of the ASLR

kernel.randomize_va_space = 2

Prohibit mapping of memory in low addresses (0)

vm.mmap_min_addr = 65536

Larger choice space for PID values

kernel.pid_max = 65536

Obfuscation of addresses memory kernel

kernel.kptr_restrict = 1

Access restriction to the dmesg buffer

kernel.dmesg_restrict = 1

Restricts the use of the perf system

kernel.perf_event_paranoid = 2
kernel. perf_event_max_sample_rate = 1
kernel. perf_cpu_time_max_percent = 1

OPTIONAL in CLIENT > MANDATORY IN SERVER:

The loading of the kernel modules can be blocked by the activation of the sysctl

kernel.modules_disabled, either directly by the following command (unsaved aer

reboot):

Listing 6.3: Blocking kernel modules loading (1)

unsaved command after reboot

sysctl -w kernel.modules_disabled =1

or by modifying the file /etc/sysctl.conf:

Listing 6.4: Blocking kernel modules loading (2)

Prohibition of loading modules (except those already loaded to this point)

by modifying the file /etc/sysctl.conf

kernel.modules_disabled = 1
.