Complete Hardened sysctl.conf for Linux Server Security
🌐 Network Stack Hardening
Ignore ICMP broadcast requests to prevent smurf attacks Ignore bogus ICMP errors Disable ICMP redirects (spoofing vector) Disable sending ICMP redirects Enable reverse path filtering (anti-spoofing) Enable TCP SYN cookies (DoS mitigation) Disable source routing Disable proxy ARP unless explicitly needed Enable ignoring of ICMP echo requests to broadcast/multicast
🧱 IPv6 Security (if used)
Disable IPv6 if unused (set to 1 to disable) Disable IPv6 router advertisements Disable IPv6 redirects
🧠 Kernel Protection and Memory Hardening
Enable address space layout randomization (ASLR) Disable core dumps for setuid programs Prevent unprivileged users from using BPF JIT compiler Prevent kernel pointer exposure Restrict use of kernel dmesg buffer Enable kernel exec-shield (if supported) Restrict access to kernel sysrq (system request) keys Disable magic SysRq entirely unless debugging Disable unprivileged user namespaces
🔒 Network Layer Timeouts and Limits
Reduce FIN timeout to prevent socket exhaustion Limit backlog queue length Enable TCP SYN backlog protection Drop time-waited connections faster Limit TCP keepalive probes Adjust TCP keepalive interval (seconds) Adjust TCP keepalive time (seconds)
📶 ARP & Routing Controls
Ignore ARP requests from non-local sources Reply only to ARP requests destined for local address Disable dynamic route cache (helps prevent route cache DoS)
🛡️ Logging and Audit Controls
Log martian packets (spoofed or invalid sources) Enable auditing of suspicious network activity Increase TCP SYN backlog
⚙️ Filesystem Hardening
Disable hardlink following Disable symlink following Enable stricter FIFO and regular file restrictions
🧰 Performance and Misc
Increase file descriptor limit Increase maximum connection backlog Reduce TCP retransmission attempts Optimize TCP window scaling Enable network congestion control (CUBIC by default) Enable fair queue (FQ) pacing for smoother bandwidth
💡 Apply & Verify Changes
Save the file: Apply all rules immediately: Verify settings applied:
✅ Recommended Companion Tools
fail2ban — blocks repeated login attempts ufw — simple firewall interface rkhunter — rootkit scanner lynis — full system audit auditd — kernel-level logging for compliance
Conclusion
| File: | /etc/sysctl.conf |
| Purpose: | Secure network stack, kernel behavior, and memory handling against common attacks. |
| Applies to: | Ubuntu, Debian, CentOS, Rocky, Alma, Arch, Fedora, RHEL |
🌐 Network Stack Hardening
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.icmp_echo_ignore_all = 0
🧱 IPv6 Security (if used)
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
🧠 Kernel Protection and Memory Hardening
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
net.core.bpf_jit_harden = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.exec-shield = 1
kernel.sysrq = 0
kernel.sysrq = 0
kernel.unprivileged_userns_clone = 0
🔒 Network Layer Timeouts and Limits
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_syn_retries = 5
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_time = 1800
📶 ARP & Routing Controls
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.route.flush = 1
🛡️ Logging and Audit Controls
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_invalid_ratelimit = 500
net.ipv4.tcp_max_syn_backlog = 4096
⚙️ Filesystem Hardening
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2
🧰 Performance and Misc
fs.file-max = 2097152
net.core.somaxconn = 1024
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_congestion_control = cubic
net.core.default_qdisc = fq
💡 Apply & Verify Changes
sudo nano /etc/sysctl.conf
sudo sysctl -p
sudo sysctl -a | grep net.ipv4
✅ Recommended Companion Tools
Conclusion
This configuration protects your VPS from spoofing, DoS floods, kernel exploits, and filesystem abuse. It reduces network noise, strengthens address randomization, and enforces privilege separation at the kernel level — forming a solid foundation for any hardened Linux system.