Ubuntu Forums Archive Viewer

hardening sys.ctl - one question

Archived thread 1010401 from Security. Markdown source: Security/thread_1010401_hardening_sys.ctl_-_one_question.md

Original URL About this archive
#1

I've been looking to add a little bit of security to my laptop and I'm using an example that looks repetative:

# Disables IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

Are these values repetative or do I need them all?

#2

IP source routing is an IP option where the source can determine the routers the traffic will take to get to its destination. I think it's pretty much irrelevant now since it's so common for routers to drop IP source routed packets.

The "Enable IP spoofing protection, turn on source route verification" is I believe *reverse path filtering*, which can be explained here

The "Disable ICMP Redirect Acceptance" should probably be enabled to prevent someone from using ICMP redirect packets to tell your computer to send its traffic to a different router.

#3

good to know more about what the values mean. i just wondering if are all these values necessary though? I've seen a couple of examples where just "all" was used.