- update

[projects/rc-scripts.git] / sysctl.conf

diff --git a/sysctl.conf b/sysctl.conf
index 4004a8c5e94d125069366d9d00b725b484150f11..9b50cb9aa7265229880afa0e83f409b4d71fd641 100644 (file)
--- a/sysctl.conf
+++ b/sysctl.conf
@@ -5,6 +5,7 @@ net.ipv4.ip_forward = 0
 
 # Enables source route verification
 net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
 
 # Accept ICMP redirect messages (suggested 1 for hosts and 0 for routers)
 # net.ipv4.conf.all.accept_redirects = 1
@@ -79,7 +80,7 @@ net.ipv4.conf.all.rp_filter = 1
 # net.ipv4.tcp_stdurg = 1
 
 # Enable tcp_syncookies
-net.ipv4.tcp_syncookies = 1
+# net.ipv4.tcp_syncookies = 1
 
 # Disable window scaling as defined in RFC1323 ?
 # The window scale extension expands the definition of the TCP
@@ -95,7 +96,7 @@ net.ipv4.tcp_syncookies = 1
 # port. Contains two numbers, the first number is the lowest port,
 # the second number the highest local port. Default is "1024 4999".
 # Should be changed to "32768 61000" for high-usage systems.
-net.ipv4.ip_local_port_range = 1024 4999
+# net.ipv4.ip_local_port_range = 4096 61000
 
 # Disables automatic defragmentation (needed for masquerading, LVS)
 # Non existant on Linux 2.4
@@ -126,47 +127,55 @@ net.ipv4.ip_local_port_range = 1024 4999
 # fs.file-max = 8192
 # fs.inode-max = 16384
 
+# Controls whether core dumps will append the PID to the core filename.
+# Useful for debugging multi-threaded applications.
+#kernel.core_uses_pid = 1
+
 # Enable the magic-sysrq key
 kernel.sysrq = 1
 
 #
 # GRSECURITY http://www.grsecurity.org
-# kernel 2.4 only
 #
 # WARNING!
 # These values are SET ONCE!
 #
 #kernel.grsecurity.linking_restrictions = 1
 #kernel.grsecurity.fifo_restrictions = 1
-#kernel.grsecurity.secure_fds = 1
-#kernel.grsecurity.chroot_restrictions = 1
-#kernel.grsecurity.chroot_execlog = 0
+#kernel.grsecurity.destroy_unused_shm = 0
 #kernel.grsecurity.chroot_caps = 0
-#kernel.grsecurity.secure_kbmap = 0
+#kernel.grsecurity.chroot_deny_chmod = 0
+#kernel.grsecurity.chroot_deny_chroot = 1
+#kernel.grsecurity.chroot_deny_fchdir = 0
+#kernel.grsecurity.chroot_deny_mknod = 1
+#kernel.grsecurity.chroot_deny_mount = 1
+#kernel.grsecurity.chroot_deny_pivot = 1
+#kernel.grsecurity.chroot_deny_shmat = 0
+#kernel.grsecurity.chroot_deny_sysctl = 1
+#kernel.grsecurity.chroot_deny_unix = 0
+#kernel.grsecurity.chroot_enforce_chdir = 0
+#kernel.grsecurity.chroot_execlog = 0
+#kernel.grsecurity.chroot_findtask = 1
+#kernel.grsecurity.chroot_restrict_nice = 0
 
 #kernel.grsecurity.exec_logging = 0
-#kernel.grsecurity.suid_logging = 0
 #kernel.grsecurity.signal_logging = 1
 #kernel.grsecurity.forkfail_logging = 0
 #kernel.grsecurity.timechange_logging = 1
+#kernel.grsecurity.audit_chdir = 0
+#kernel.grsecurity.audit_gid = 65505
+#kernel.grsecurity.audit_group = 0
+#kernel.grsecurity.audit_ipc = 0
+#kernel.grsecurity.audit_mount = 0
 
 #kernel.grsecurity.execve_limiting = 1
-#kernel.grsecurity.fork_bomb_prot = 0
-#kernel.grsecurity.fork_bomb_gid = 65504
-#kernel.grsecurity.fork_bomb_sec = 40
-#kernel.grsecurity.fork_bomb_max = 20
-#kernel.grsecurity.tpe = 0
+#kernel.grsecurity.dmesg = 1
+#kernel.grsecurity.tpe = 1
 #kernel.grsecurity.tpe_gid = 65500
 #kernel.grsecurity.tpe_glibc = 0
 #kernel.grsecurity.tpe_restrict_all = 0
 
-#kernel.grsecurity.rand_pids = 0
-#kernel.grsecurity.rand_ip_ids = 0
-#kernel.grsecurity.rand_tcp_src_ports = 0
-#kernel.grsecurity.altered_pings = 0
-#kernel.grsecurity.rand_ttl = 0
-#kernel.grsecurity.rand_ttl_thresh = 64
-#kernel.grsecurity.rand_net = 1
+#kernel.grsecurity.rand_pids = 1
 #kernel.grsecurity.socket_all = 1
 #kernel.grsecurity.socket_all_gid = 65501
 #kernel.grsecurity.socket_client = 1
@@ -174,10 +183,23 @@ kernel.sysrq = 1
 #kernel.grsecurity.socket_server = 1
 #kernel.grsecurity.socket_server_gid = 65503
 
-#kernel.grsecurity.stealth_flags = 0
-#kernel.grsecurity.stealth_icmp = 0
-#kernel.grsecurity.stealth_igmp = 0
-#kernel.grsecurity.stealth_rst = 0
-#kernel.grsecurity.stealth_udp = 0
-
-#kernel.grsecurity.coredump = 0
+#kernel.grsecurity.disable_modules = 0
+#kernel.grsecurity.grsec_lock = 0
+
+# kernel.randomize_va_space = 2
+# 0 - Turn the process address space randomization off by default.
+# 1 - Conservative address space randomization makes the addresses of
+#     mmap base and VDSO page randomized. This, among other things,
+#     implies that shared libraries will be loaded to random addresses.
+#     Also for PIE binaries, the location of code start is randomized.
+# 2 - This includes all the features that Conservative randomization
+#     provides. In addition to that, also start of the brk area is randomized.
+#     There a few legacy applications out there (such as some ancient
+#     versions of libc.so.5 from 1996) that assume that brk area starts
+#     just after the end of the code+bss. These applications break when
+#     start of the brk area is randomized. There are however no known
+#     non-legacy applications that would be broken this way, so for most
+#     systems it is safe to choose Full randomization.
+
+# for mplayer
+#dev.rtc.max-user-freq = 1024