← News
/PLAYBOOK · 2026-08-24

Linux sysctl Kernel Hardening: System Parameter Defense

Hands-on Linux sysctl kernel hardening. net.ipv4/IPv6, kernel, vm and related security knobs — what they do and how to set them. One sysctl.conf drop for anti-spoofing, flood mitigation, and kernel parameter protection.

sysctl kernel hardening is the cheapest Linux server baseline and the one most often skipped. Tune runtime knobs under `/proc/sys` to disable IP forwarding, block IP spoofing, blunt SYN floods, and stop kernel dumps of sensitive state. Shrink the attack surface at the OS layer. Copy-paste config and verification below.

Use Cases

Prerequisites

How It Works

The kernel exposes runtime parameters via the `/proc/sys` virtual filesystem. `sysctl` is the management interface. Whether a change is live depends on the knob: most net.* parameters hot-reload; some kernel.* need a reboot. Persist in /etc/sysctl.conf; systemd-sysctl loads it at boot. Correct settings cut IP spoofing, SYN floods, ICMP redirect hijack, and kernel info leaks.

Procedure

Step 1: Back Up Current Config

`cp /etc/sysctl.conf /etc/sysctl.conf.bak
sysctl -a | wc -l   # view current total parameter count`

Step 2: Write Hardening Config

Edit /etc/sysctl.conf and append:

`# ===== Network-layer hardening =====
net.ipv4.ip_forward = 0                    # disable IP forwarding
net.ipv4.conf.all.accept_redirects = 0     # reject ICMP redirects
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0       # do not send redirects
net.ipv4.conf.all.accept_source_route = 0  # disable source routing
net.ipv4.conf.all.rp_filter = 1            # enable reverse path filtering to prevent IP spoofing
net.ipv4.conf.default.rp_filter = 1

# ===== SYN flood defense =====
net.ipv4.tcp_syncookies = 1                # enable SYN Cookies
net.ipv4.tcp_syn_retries = 2               # reduce SYN retry count
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 2048        # increase half-open connection queue

# ===== Kernel protection =====
kernel.kptr_restrict = 1                   # restrict /proc/kallsyms from exposing kernel addresses
kernel.dmesg_restrict = 1                  # deny unprivileged users from reading dmesg
kernel.core_uses_pid = 1
fs.suid_dumpable = 0                       # disable core dumps for SUID programs

# ===== Resource limits =====
net.core.somaxconn = 1024
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216`

Step 3: Load and Verify

`sudo sysctl -p                        # load config (skip comments and unknown parameters)
sudo sysctl net.ipv4.tcp_syncookies  # verify output net.ipv4.tcp_syncookies = 1
sudo sysctl -p --system 2>/dev/null | grep -c error   # check load error count`

Verification

Confirm key parameters are live:

`sysctl net.ipv4.conf.all.rp_filter net.ipv4.tcp_syncookies kernel.kptr_restrict kernel.dmesg_restrict`

All values 1 means hardening took. Use `sysctl -a | grep 'key'` for exact lookup. Some net parameters do not apply to existing sockets. Run in a maintenance window and watch production connections.

FAQ

FAQ 1: rp_filter on, some legitimate traffic dropped?

rp_filter=1 can punish asymmetric routing on multi-NIC, multi-route hosts. If you drop packets, review routing. Per-NIC, set 2 (loose mode) or tune by interface. Keep a firewall allowlist as backstop.

FAQ 2: sysctl -p says No such file or directory?

Kernel was not built with that parameter (common on slim kernels and containers). The loader skips it; the rest still apply. Confirm with `sysctl -a | grep parameter_name` before writing it.

FAQ 3: How do I roll back?

Restore the backup and reload: `cp /etc/sysctl.conf.bak /etc/sysctl.conf && sysctl -p`. net.* is immediate. Some kernel.* knobs (kptr_restrict) need a reboot to revert.

Summary

sysctl kernel hardening is the lowest-cost, fastest baseline. Combine with fail2ban, iptables, SELinux. Drop this config into server init scripts or an Ansible baseline so new hosts harden in one shot and nobody skips a knob.