# Following are maintained from a long time
# Disable an unused feature
kernel.sysrq=0

# Set TCP Challenge ACK Limit
net.ipv4.tcp_challenge_ack_limit = 1073741823

# No coredumps for setuid and setgid binaries
fs.suid_dumpable = 0

net.ipv4.tcp_timestamps = 1

# Following hardening configs are taken from
# https://github.com/RedHatOfficial/ansible-role-rhel9-stig/blob/main/defaults/main.yml
# (most of these are in our stig hardening playbook as well)

# Disable IP forwarding
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Enable reverse path filtering to prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore broadcast ICMP requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus ICMP error responses
#net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable TCP SYN cookies to protect against SYN flood attacks
net.ipv4.tcp_syncookies = 1

# Disable sending ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Disable acceptance of ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Disable secure redirects
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

# Log martian packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Disable source routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Disable acceptance of router advertisements
#net.ipv6.conf.all.accept_ra = 0
#net.ipv6.conf.default.accept_ra = 0

# Disable IPv6 auto-configuration
#net.ipv6.conf.all.autoconf = 0
#net.ipv6.conf.default.autoconf = 0

# Disable acceptance of IPv6 redirects
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable router solicitations
#net.ipv6.conf.all.router_solicitations = 0
#net.ipv6.conf.default.router_solicitations = 0

# Limit number of IPv6 addresses per interface
#net.ipv6.conf.all.max_addresses = 1
#net.ipv6.conf.default.max_addresses = 1

# Restrict kernel pointer exposure
kernel.kptr_restrict = 2

# Enable address space layout randomization (ASLR)
kernel.randomize_va_space = 2

# Restrict access to kernel logs
kernel.dmesg_restrict = 1

# Harden symlink and hardlink handling
fs.protected_hardlinks = 1
fs.protected_symlinks = 1