Linux sysctl hardening: the kernel settings worth changing

Runtime kernel knobs

sysctl reads and writes kernel parameters exposed under /proc/sys. Values set with sysctl -w last until reboot. Files in /etc/sysctl.d/ make them permanent and are applied at boot or with sysctl --system.

Many distribution defaults are already sensible. The goal is to know the handful that matter and verify them, not to paste a long list from the internet.

Snippet

sysctl net.ipv4.ip_forward kernel.kptr_restrict kernel.dmesg_restrict kernel.yama.ptrace_scope
ls /etc/sysctl.d/

Settings with a clear purpose

net.ipv4.conf.all.rp_filter = 1 drops packets whose source address could not be routed back through the receiving interface, which blocks simple spoofing. accept_redirects = 0 and send_redirects = 0 stop ICMP redirects from changing routes on hosts that are not routers. ip_forward should be 0 unless the host routes traffic.

kernel.kptr_restrict = 2 hides kernel pointers that help exploit development. kernel.dmesg_restrict = 1 limits the kernel log to privileged users. kernel.yama.ptrace_scope = 1 or higher stops a process from attaching a debugger to unrelated processes of the same user, which limits credential theft from memory.

Lab: apply and verify

Write the settings below to /etc/sysctl.d/90-hardening.conf, apply with sysctl --system, and confirm with sysctl. As an ordinary user, try dmesg and confirm it is denied. Start a sleep process and try to attach to it with gdb -p or strace -p from another shell of the same user, and confirm ptrace_scope blocks it.

Reboot the VM and check the values persist.

Snippet

# /etc/sysctl.d/90-hardening.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.yama.ptrace_scope = 1

sudo sysctl --system
sleep 600 & strace -p $!

Test before rolling out

Routers, VPN servers, and Kubernetes nodes need ip_forward = 1 and may need looser rp_filter. Debugging tools need ptrace. Roll changes out by role, not with one file for every host.

Include the sysctl file in configuration management so it cannot drift.

Diagram

Kernel settings and what they stop

Each value answers one specific risk.

rp_filter = 1
Spoofed source addresses on the wrong interface.
accept_redirects = 0
Route changes from forged ICMP redirects.
kptr_restrict = 2
Kernel address leaks that aid exploits.
ptrace_scope = 1
One process reading another’s memory.

Check yourself

1. Where should persistent sysctl settings go?

2. Which setting limits processes from attaching to other processes with ptrace?

3. Why not set ip_forward = 0 on every host?