mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-22 20:33:35 +07:00
Code Issues Packages Projects Releases Wiki Activity

Provide option to drop gratuitous ARP packets

Browse Source
This commit is contained in:
raja-grewal 2024-11-08 03:58:23 +00:00 committed by GitHub
parent 3af2684134
commit a1d1f97955
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -121,6 +121,9 @@ Networking:
- Optional - Enable IPv6 Privacy Extensions.
- Optional - Drop gratuitous ARP packets to prevent ARP cache poisoning
via man-in-the-middle and denial-of-service attacks.
### Boot parameters
Mitigations for known CPU vulnerabilities are enabled in their strictest form

11
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -526,3 +526,14 @@ net.ipv4.tcp_timestamps=0
## The use of IPv6 Privacy Extensions is currently disabled due to these breakages.
##
#net.ipv6.conf.*.use_tempaddr=2
## Drop gratuitous ARP (Address Resolution Protocol) packets.
## Stops ARP responses sent by a device without being explicitly requested.
## Prevents ARP cache poisoning by rejecting fake ARP entries into a network.
## Prevents man-in-the-middle and denial-of-service attacks.
## May cause breakages when ARP proxies are used in the network.
##
## https://patchwork.ozlabs.org/project/netdev/patch/1428652454-1224-3-git-send-email-johannes@sipsolutions.net/
## https://www.practicalnetworking.net/series/arp/gratuitous-arp/
##
#net.ipv4.conf.*.drop_gratuitous_arp=1