Network Kernel Settings¶

The kernel's network stack has switches that decide whether the machine forwards packets, obeys redirects, and answers to spoofed addresses. They're read live from /proc/sys/net/ and set permanently in /etc/sysctl.conf or a file in /etc/sysctl.d/. An image can flip them to turn the machine into a router or make it easier to spoof.

The values¶

Setting	Value	Why
`net.ipv4.ip_forward`, `net.ipv4.conf.all.forwarding`, `net.ipv4.conf.default.forwarding`, `net.ipv6.conf.all.forwarding`, `net.ipv6.conf.default.forwarding` (CIS 3.3.1; Debian CIS 3.3.1.1 to 3.3.1.3, 3.3.2.1, 3.3.2.2)	0	The machine isn't a router; forwarding lets an attacker route through it
`net.ipv4.conf.all.send_redirects`, `net.ipv4.conf.default.send_redirects` (3.3.2)	0	Don't tell other hosts to change their routes
`net.ipv4.conf.all.accept_redirects`, `net.ipv4.conf.default.accept_redirects` (3.3.5)	0	Don't let other hosts change ours (man-in-the-middle by ICMP)
`net.ipv4.conf.all.secure_redirects`, `net.ipv4.conf.default.secure_redirects` (3.3.6)	0	Same, even from gateways
`net.ipv4.conf.all.accept_source_route`, `net.ipv4.conf.default.accept_source_route` (3.3.8)	0	Reject packets that specify their own route (used to bypass filtering)
`net.ipv4.conf.all.rp_filter`, `net.ipv4.conf.default.rp_filter` (3.3.7)	1	Reverse-path filtering: drop packets whose source address couldn't have arrived on that interface
`net.ipv4.conf.all.log_martians`, `net.ipv4.conf.default.log_martians` (3.3.9)	1	Log packets with impossible source addresses
`net.ipv4.icmp_echo_ignore_broadcasts` (3.3.4)	1	Don't answer pings to the broadcast address (smurf amplification)
`net.ipv4.icmp_ignore_bogus_error_responses` (3.3.3)	1	Don't log garbage ICMP errors
`net.ipv4.tcp_syncookies` (3.3.10)	1	Survive SYN floods
`net.ipv4.tcp_timestamps`	1 (default) or 0	1 is normal; 0 hides uptime. Either is fine; avoid other values.
`net.ipv4.conf.all.proxy_arp`	0	Don't answer ARP for other hosts
`net.ipv4.conf.all.bootp_relay`	0	Don't relay DHCP
`net.ipv4.conf.all.mc_forwarding`	0	Don't forward multicast (read-only on some kernels; ignore an error)
`net.ipv6.conf.all.accept_redirects`, `net.ipv6.conf.default.accept_redirects`	0	IPv6 version of the redirect rule
`net.ipv6.conf.all.accept_source_route`, `net.ipv6.conf.default.accept_source_route`	0
`net.ipv6.conf.all.accept_ra`, `net.ipv6.conf.default.accept_ra` (3.3.11)	0	Don't take router advertisements from anyone (rogue RA attack); leave at 1 only if the README says IPv6 is in use
`net.core.bpf_jit_harden`	2	Hardens the BPF just-in-time compiler for all users

The benchmark's 3.1.1 asks you to decide whether IPv6 is in use at all. ip -6 addr shows whether the machine has a global IPv6 address; on a contest network it usually doesn't. Either way the IPv6 lines above are set.

Network protocols nobody uses¶

Four kernel modules implement network protocols that have had exploitable bugs and that nothing on a Mint or Debian image uses: dccp, tipc, rds, sctp (CIS 3.2.1 to 3.2.4). Block them the same way as the filesystem modules on the Kernel Modules page: one two-line file per module under /etc/modprobe.d/, then modprobe -n -v dccp to confirm it answers install /bin/false.

Apply¶

Kernel settings are loaded from files in /etc/sysctl.d/ (in name order) and then /etc/sysctl.conf. Create your own file:

sudo nano /etc/sysctl.d/60-network-hardening.conf

Each line is key = value, exactly as the table spells the key:

net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

Add the rest of the table the same way. Then load everything and watch the output:

sudo sysctl --system

* Applying /etc/sysctl.d/60-network-hardening.conf ...
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
...

Every key you set is echoed back. A key that isn't echoed was misspelled, and a key echoed twice with different values is being overridden by a later file. That second case matters: a later file or /etc/sysctl.conf can set the same key the other way, so check them:

grep -rE 'ip_forward|accept_redirects|rp_filter' /etc/sysctl.conf /etc/sysctl.d/

If the README says the machine is a router or VPN gateway, ip_forward stays 1 and the rest still apply.

Verify¶

sysctl net.ipv4.ip_forward net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.rp_filter net.ipv4.tcp_syncookies net.ipv6.conf.all.accept_redirects
cat /proc/sys/net/ipv4/ip_forward

The /proc files are the live truth; sysctl reads them.

Example¶

sysctl net.ipv4.ip_forward returns 1 and /etc/sysctl.conf has an uncommented net.ipv4.ip_forward=1 line with the comment "for docker". The README doesn't mention containers or routing. Set it to 0 in sysctl.conf (so it doesn't override the drop-in), write the drop-in, sysctl --system, confirm 0.

Try it¶

Set ip_forward to 1 with sysctl -w, read /proc/sys/net/ipv4/ip_forward, then run sysctl --system and read it again.
Put a conflicting value in /etc/sysctl.conf and see which wins.

Build it¶

A sysctl-check.sh that reads a file of key = expected pairs and prints every key whose live value differs. Works for the network, kernel, and filesystem pages alike.

Next¶

Kernel Hardening