mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-23 01:23:36 +07:00
Code Issues Packages Projects Releases Wiki Activity

Patch bug in existing rp_filter sysctl

Browse Source
This commit is contained in:
Raja Grewal 2024-08-16 19:23:48 +10:00
parent 23a77d4973
commit fae586c3c5
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -270,12 +270,15 @@ net.ipv4.tcp_rfc1337=1
## Enable reverse path filtering (source validation) of packets received from all interfaces.
## Prevents IP spoofing and mitigates vulnerabilities such as CVE-2019-14899.
## The second "default" command fixes a bug in the existing kernel implementation.
##
## https://en.wikipedia.org/wiki/IP_address_spoofing
## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
## https://seclists.org/oss-sec/2019/q4/122
## https://github.com/Kicksecure/security-misc/pull/261
##
net.ipv4.conf.*.rp_filter=1
net.ipv4.conf.default.rp_filter=1
## Disable ICMP redirect acceptance and redirect sending messages.
## Prevents man-in-the-middle attacks and minimizes information disclosure.