====== Sécurité kernel ======

Options kernels à utiliser pour restreindre des comportements de routage, ICMP... inutiles à proposer.

Pour de nombreux paramètres réseaux, configurer le fichier suivant qui liste les paramètres kernel à exécuter au démarrage.

<code>
vi /etc/sysctl.d/custom.conf
</code>

<code>
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_forward = 0 #Inclus la ligne suivante : net.ipv4.conf.docker0.forwarding = 0
net.ipv6.conf.all.forwarding=0
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.proxy_arp = 0

###################################################################
# Custom
vm.swappiness=2
</code>

Pour charger la configuration modifiée sans redémarrer.
<code>
sysctl -p
</code>

''sysctl.conf'' complet.
<code>
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

##############################################################3
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=0

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=0

###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
net.ipv4.conf.all.secure_redirects = 0

# gateway list (enabled by default)
net.ipv4.conf.all.secure_redirects = 0
#
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
net.ipv4.conf.all.log_martians = 1
#
# Proxy ARP
net.ipv4.conf.all.proxy_arp = 0

###################################################################
# Magic system request Key
# 0=disable, 1=enable all
# Debian kernels have this set to 0 (disable the key)
# See https://www.kernel.org/doc/Documentation/sysrq.txt
# for what other values do
#kernel.sysrq=1

###################################################################
# Protected links
#
# Protects against creating or following links under certain conditions
# Debian kernels have both set to 1 (restricted) 
# See https://www.kernel.org/doc/Documentation/sysctl/fs.txt
#fs.protected_hardlinks=0
#fs.protected_symlinks=0

# Disable IPv6 autoconf 
net.ipv6.conf.all.autoconf = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.eth0.autoconf = 0
net.ipv6.conf.all.accept_ra_defrtr = 0
net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.eth0.accept_ra_defrtr = 0
net.ipv6.conf.all.accept_ra_pinfo = 0
net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.eth0.accept_ra_pinfo = 0
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.eth0.accept_ra = 0
</code>

Différence de conf entre une installation originale Debian 9 et les modifications appliquées (Original à gauche, modifié à droite).
<code>
net.ipv4.conf.all.forwarding = 1			      |	net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.log_martians = 0			      |	net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 0				      |	net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.secure_redirects = 1			      |	net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 1			      |	net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.forwarding = 1			      |	net.ipv4.conf.default.forwarding = 0
net.ipv4.conf.default.rp_filter = 0			      |	net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.docker0.forwarding = 1			      |	net.ipv4.conf.docker0.forwarding = 0
net.ipv4.conf.eth0.forwarding = 1			      |	net.ipv4.conf.eth0.forwarding = 0
net.ipv4.conf.lo.forwarding = 1				      |	net.ipv4.conf.lo.forwarding = 0
net.ipv4.ip_forward = 1					      |	net.ipv4.ip_forward = 0
net.ipv6.conf.all.accept_redirects = 1			      |	net.ipv6.conf.all.accept_redirects = 0
</code>