lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-17 18:14:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

system: add defaults for newer sysctls

Browse Source
This commit is contained in:
Franco Fichtner 2015-08-13 17:17:25 +02:00
parent 59deb5f7c8
commit 11bb2b9004
2 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/etc/config.xml.sample
View File

@ -55,16 +55,9 @@
</item>
<item>
<descr><![CDATA[
Redirect attacks are the purposeful mass issuing of ICMP type 5 packets. In a normal network, redirects
to the end stations should not be required. To defend against this type of attack both the sending and
accepting of redirect should be disabled.
]]></descr>
<tunable>net.inet.icmp.redirect</tunable>
<value>default</value>
</item>
<item>
<descr><![CDATA[
This option enables the NIC to drop all inbound ICMP redirect packets without returning a response.
Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects
to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect
packets without returning a response.
]]></descr>
<tunable>net.inet.icmp.drop_redirect</tunable>
<value>default</value>

4
src/etc/inc/system.inc
View File

@ -78,6 +78,10 @@ function get_default_sysctl_value($id)
"net.inet.tcp.recvspace" => "65228",
"net.inet.tcp.sendspace" => "65228",
"net.inet.ip.fastforwarding" => "0",
'net.inet.ip.sourceroute' => '0',
'net.inet.ip.accept_sourceroute' => '0',
'net.inet.icmp.drop_redirect' => '0',
'net.inet.icmp.log_redirect' => '0',
"net.inet.tcp.delayed_ack" => "0",
"net.inet.udp.maxdgram" => "57344",
"net.inet.ip.intr_queue_maxlen" => "1000",