시스템 보안을 위해 필자가 추천하는 커널 파라미터 값

[root@su250 ~]# cat /etc/sysctl.conf

net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.tcp_fin_timeout = 30

net.ipv4.tcp_keepalive_time = 180

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_max_syn_backlog = 1280

net.ipv4.tcp_sack = 0

net.ipv4.tcp_window_scaling = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.ip_local_port_range = 32768 61000

net.ipv4.ip_forward = 0

vm.bdflush = 100 1200 128 512 15 5000 500 1884 2

vm.buffermem = 80 10 60

kernel.sysrq = 1

net.ipv4.icmp_echo_ignore_all = 0

fs.file-max = 327680

# Controls whether core dumps will append the PID to the core filename.

# Useful for debugging multi-threaded applications.

kernel.core_uses_pid = 1

[root@su250 ~]#