Beyond application and network-layer hardening, several kernel-level parameters directly affect your server's security posture. This guide covers the security-relevant sysctl settings worth reviewing.
Why Kernel-Level Hardening Matters
The kernel enforces fundamental system behavior — certain default settings prioritize compatibility over security; adjusting them closes specific classes of attacks at the lowest system level.
Disabling IP Forwarding (Unless Genuinely Needed)
net.ipv4.ip_forward = 0Prevents your server from acting as an unintended router — only enable this if you specifically need routing functionality (e.g. a VPN gateway).
Protecting Against SYN Flood Attacks
net.ipv4.tcp_syncookies = 1Ignoring ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0Prevents potential man-in-the-middle attacks via malicious ICMP redirect messages attempting to alter your routing table.
Disabling Source Routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0Source routing lets a packet specify its own path, a technique sometimes used to bypass network security controls — disabling it closes this avenue.
Enabling Reverse Path Filtering
net.ipv4.conf.all.rp_filter = 1Helps prevent IP spoofing by verifying incoming packets have a legitimate return path via the interface they arrived on.
Logging Martian Packets
net.ipv4.conf.all.log_martians = 1Logs packets with impossible/spoofed source addresses, useful for detecting certain attack patterns.
Restricting Core Dumps for setuid Programs
fs.suid_dumpable = 0Prevents privileged programs from generating core dumps that could potentially expose sensitive memory content.
Restricting Access to Kernel Pointers
kernel.kptr_restrict = 2Hides kernel memory addresses from unprivileged users, making certain kernel exploitation techniques more difficult.
Restricting dmesg Access
kernel.dmesg_restrict = 1Prevents unprivileged users from reading kernel log messages, which can sometimes reveal information useful to an attacker.
Applying These Settings
sudo nano /etc/sysctl.d/99-security-hardening.confAdd your chosen settings, then apply:
sudo sysctl -p /etc/sysctl.d/99-security-hardening.confTesting Before Applying to Production
Some of these settings can affect legitimate functionality in specific network configurations (e.g. IP forwarding if you actually need routing) — understand what each setting does and verify it's appropriate for your specific server's role before applying broadly.
Common Errors
Legitimate routing/VPN functionality breaks after hardening — review whether ip_forward or other network-behavior settings were inappropriately disabled for a server that specifically needs that functionality (like a VPN gateway).
Continue Reading
- How to Manage Kernel Parameters with sysctl
- VPS Security Checklist for Beginners
- How to Harden a Fresh Linux VPS in 15 Minutes
Browse more articles in Server Security & Hardening.
