ubuntu/RandomKernel at main · Ghost414Entourage/ubuntu · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
sysctl -a


/etc/sysctl.conf
/etc/sysctl.d/


sudo sysctl -p


sudo sysctl -w net.ipv4.ip_forward=0

sudo sysctl -w net.ipv4.conf.all.rp_filter=1

sudo sysctl -w net.ipv4.tcp_syncookies=1

sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

sudo sysctl -w net.ipv4.conf.all.send_redirects=0

sudo sysctl -w kernel.kptr_restrict=2

sudo sysctl -w kernel.randomize_va_space=2

sudo sysctl -w fs.suid_dumpable=0

sudo sysctl -w kernel.pid_max=65535

sudo sysctl -w fs.file-max=100000


/etc/sysctl.d/99-hardening.conf:

net.ipv4.ip_forward=0
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects=0
kernel.kptr_restrict=2
kernel.randomize_va_space=2


sudo sysctl --system


List loaded modules:

lsmod


Unnecessary modules should be blacklisted.
Example blacklist file:

/etc/modprobe.d/blacklist.conf


sudo sysctl -w kernel.unprivileged_userns_clone=0


sudo sysctl -w kernel.yama.ptrace_scope=1