99-sysctl.conf

[Karren Bangura]

okso i am very paranoid if you wanna call me that and im very big on security ive done a LOT of research or at least as much as i can find i have sysctl.conf and 99-sysctl.conf set up but i am wondering are all my commands or configs safe and if not which ones and why tell me what you think. thank you

In plain words, sysctl.conf is a time honored way to execute commands on bootup that modify default processor settings, in this case networking.

The advantage of doing this is that you can avoid re-compiling the kernel with different settings.

In the following paper I wrote long ago,

I described how to inspect values and set by command line using both /proc and sysctl commands, then placing them in the /etc/sysctl.conf file, with the purposes of setting the TCP/IP Congestion Control algorithm and enlarging and optimizing Networking related values, increasing capacity.

i have learned a lot about kernel and system hardening and my problem is how can i check or verify my commands in sysctl is actually working?

these r the commands i use and i know i have vmswappiness set to 0 but the reason i ask to confirm these commands is because i notice my system is still using swap space even though vmwappiness is set to 0 why is this and is this a correct way to get these commands to work in suse or shuld i use yast and the editing sysctl configuration there?

and aside from adding .config files in /etc/sysctl.d/99-sysctl.conf and /etc/sysctl.conf if i use yast to do so i cant seem to find a simple way to add these commands to it even with a search in yast sysctl config gui with the commands below but i mostly just want to know if these r being applied and how can i check and why is my system still using swap space?

thank you all very much for your kind responses i suppose now all i have to ask is how do i disable swap? also if i set vm.swappiness to 100 instead of 0 will it make the system prefer system memory instead of system cache to disk.

also there is no swap anything in fstab and in the bootloader in yast there is no option like that? and i even checked my girlfriends computer with suse and she dosent have those options eather sooooo will what i suggested work or well ill test it and let u know but yea thanks also will it work adding the swapoff -a option to my sysctl.conf? thanks

The systemd.swap MAN page describes how swap works now in systemd

The systemd-fstab-generator MAN page describes how the appropriate systemd Unit file is created when a fstab entry exists, and if you run the following command, you will see at least one systemd Unit file exists on your system (identified by uuid so it will be different for every system)

The sysctl preload/configuration file can be created at /etc/sysctl.d/99-sysctl.conf. For systemd, /etc/sysctl.d/ and /usr/lib/sysctl.d/ are drop-in directories for kernel sysctl parameters. The naming and source directory decide the order of processing, which is important since the last parameter processed may override earlier ones. For example, parameters in a /usr/lib/sysctl.d/50-default.conf will be overriden by equal parameters in /etc/sysctl.d/50-default.conf and any configuration file processed later from both directories.

The parameters available are those listed under /proc/sys/. For example, the kernel.sysrq parameter refers to the file /proc/sys/kernel/sysrq on the file system. The sysctl --all command can be used to display all currently available values.

In the event of a synflood DOS attack, this queue can fill up pretty quickly, at which point TCP SYN cookies will kick in allowing your system to continue to respond to legitimate traffic, and allowing you to gain access to block malicious IPs.

tcp_tw_reuse sets whether TCP should reuse an existing connection in the TIME-WAIT state for a new outgoing connection if the new timestamp is strictly bigger than the most recent timestamp recorded for the previous connection.

Specify how many seconds to wait for a final FIN packet before the socket is forcibly closed. This is strictly a violation of the TCP specification, but required to prevent denial-of-service attacks. In Linux 2.2, the default value was 180 [3]:

TCP keepalive is a mechanism for TCP connections that help to determine whether the other end has stopped responding or not. TCP will send the keepalive probe that contains null data to the network peer several times after a period of idle time. If the peer does not respond, the socket will be closed automatically. By default, TCP keepalive process waits for two hours (7200 secs) for socket activity before sending the first keepalive probe, and then resend it every 75 seconds. As long as there is TCP/IP socket communications going on and active, no keepalive packets are needed.

TCP Selective Acknowledgement (TCP SACK), controlled by the boolean tcp_sack, allows the receiving side to give the sender more detail about lost segments, reducing volume of retransmissions. This is useful on high latency networks, but disable this to improve throughput on high-speed LANs. Also disable tcp_dsack, if you aren't sending SACK you certainly don't want to send duplicates! Forward Acknowledgement works on top of SACK and will be disabled if SACK is. [5]

By enabling reverse path filtering, the kernel will do source validation of the packets received from all the interfaces on the machine. This can protect from attackers that are using IP spoofing methods to do harm.

A martian packet is an IP packet which specifies a source or destination address that is reserved for special-use by Internet Assigned Numbers Authority (IANA). See Reserved IP addresses for more details.

The IPPROTO_ICMP (icmp(7)) socket type adds the possibility to send ICMP_ECHO messages and receive corresponding ICMP_ECHOREPLY messages without the need to open a raw(7) socket, an operation which requires the CAP_NET_RAW capability or the SUID bit with a proper privileged owner. These ICMP_ECHO messages are sent by the ping application thus making the IPPROTO_ICMP socket also known as ping socket in addition to ICMP Echo socket.

ping_group_range determines the GID range of groups which their users are allowed to create IPPROTO_ICMP sockets. Additionally, the owner of the CAP_NET_RAW capability is also allowed to create IPPROTO_ICMP sockets. By default this range is 1 0 which means no one is allowed to create IPPROTO_ICMP sockets except root. To take advantage of this setting programs which currently uses raw sockets need to ported to use IPPROTO_ICMP sockets instead. For example, QEMU uses IPPROTO_ICMP for SLIRP aka User-mode networking, so allowing the user running QEMU to create IPPROTO_ICMP sockets means it is possible to ping from the guest.

There are several key parameters to tune the operation of the virtual memory subsystem of the Linux kernel and the write out of dirty data to disk. See the official Linux kernel documentation for more information. For example:

As noted in the comments for the parameters, one needs to consider the total amount of RAM when setting these values. For example, simplifying by taking the installed system RAM instead of available memory:

/etc/sysctl.conf is actually not loaded, but only via a trick as there is a symlink /etc/sysctl.d/99-sysctl.conf pointing to /etc/sysctl.conf. So the latter one is a legacy file, kept effective for backwards-compatibility only, but you should not use it anymore.

The issue in your cases might indeed be that the required kernel module has not yet been loaded when those sysctl settings are. Adding a new file like echo nf_conntrack > /etc/modules-load.d/nf_conntrack.conf to have it loaded at boot should work.

No matter which distribution one uses, I would not modify /etc/sysctl.conf directly but create a file (e.g. with Kate or your favourite CLI text editor) called 99-sysswappiness.conf in /etc/sysctl.d/ (so this modification does not get overwritten when a new sysctl.conf is installed in an update and also gets called after a possible 99-sysctl.conf of your distribution) with the following content:

On a side note.

I do not understand why someone would force a specific block size to a partition that is not designed for that size by the partition table.

What is described in that link will not make anything boot faster it just force changes the block size outside of what the partition table wants. You might save a few megabytes here and there, but storage space cost near to nothing today. A very strange thing to do imo.

If you use MBR, use mbr partition recommendations.

If you use GPT, follow those.

There is absolutely zero reason to do anything on KDE Neon, it works out of the box 99% of the time.

The only thing this would accomplish is to gain a fraction of efficiency and remove functionalities of the system.

Zswap is a compressed memory buffer like Zram but unlike Zram it's designed to work with a physical swap device (in fact it's useless without "real" swap). Zswap is generally a better option if you have a swap file or partition as it is smart enough to keep more actively used memory pages in the zswap buffer while moving inactive pages to the backing physical swap. Zram doesn't do this which can lead to inefficient behavior where the physical swap will start being used once the zram device is full even if the zram device is full of rarely used memory pages.

To enable zswap you first need to disable zram (otherwise they'll interact together and be really inefficient). Disabling Zram is as simple as creating an empty zram-generator configuration which will tell zram-generator to do nothing when you boot.

3a8082e126