Skip to content

Commit b291beb

Browse files
committed
added more deployment methods and explanations
1 parent b260f22 commit b291beb

File tree

1 file changed

+108
-18
lines changed

1 file changed

+108
-18
lines changed

README.md

Lines changed: 108 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# K4YT3X's Hardened sysctl Configuration
22

3-
This repository hosts my hardened version of `sysctl.conf`. This configuration file aims to provide better security for Linux systems, and improves system performance whenever possible. For example, below are some of the features this configuration file provies.
3+
This repository hosts my hardened version of `sysctl.conf`. This configuration file aims to provide better security for Linux systems and improves system performance whenever possible. For example, below are some of the features this configuration file provides.
44

55
- Prevents kernel pointers from being read
66
- Disables Ptrace for all programs
@@ -11,17 +11,78 @@ This repository hosts my hardened version of `sysctl.conf`. This configuration f
1111
- Enables IP reverse path filtering for source validation
1212
- ...
1313

14-
**Please review the configuration file carefully before applying it.** You are responsible for actions done to your own system. If you need some guidance understanding what each of the settings are for, [sysctl-explorer](https://sysctl-explorer.net/) might come in handy.
14+
**Please review the configuration file carefully before applying it.** You are responsible for actions done to your system. If you need some guidance understanding what each of the settings is for, [sysctl-explorer](https://sysctl-explorer.net/) might come in handy. You may also consult [Linux's kernel documentation](https://www.kernel.org/doc/Documentation/sysctl/).
1515

16-
Please be careful that this `sysctl.conf` is **designed for 64-bit endpoint hosts that do not act as a router**. If you would like to use this configuration file on a router, please go over the configuration file and make necessary changes.
16+
Please be aware that this `sysctl.conf` is **designed for 64-bit endpoint hosts that do not act as a router**. If you would like to use this configuration file on a router, please go over the configuration file and make the necessary changes (e.g., set `net.ipv4.ip_forward` to `1`).
1717

18-
## Usages
18+
## Configuration Deployment
1919

20-
1. Download the file `sysctl.conf` from the repository
21-
1. **Review the content of the `sysctl.conf` file to make sure all settings are suitable for your system**
22-
1. Backup your current `/etc/sysctl.conf` file (e.g., `cp /etc/sysctl.conf /etc/sysctl.conf.backup`)
23-
1. Overwrite the old `sysctl.conf` file with the downloaded `sysctl.conf` file
24-
1. Run command `sudo sysctl -p` or reboot the system to apply the changes
20+
Linux kernel configuration files are stored in the directory `/etc/sysctl.d`. Configurations in all files having a suffix of `.conf` will read by the `procps` (a.k.a. `systemd-sysctl`) service. Additionally, the `procps` service also loads configurations from the following directories.
21+
22+
- `/run/sysctl.d`
23+
- `/usr/local/lib/sysctl.d`
24+
- `/usr/lib/sysctl.d`
25+
- `/lib/sysctl.d`
26+
27+
Files are sorted and read by their file names in lexicographic order. Variables read later will overwrite variables read earlier. For example, configurations in `20-something.conf` will be read before `99-sysctl.conf`. If a variable exists in both files, values read from `20-something.conf` will be overwritten by values read from `99-sysctl.conf`.
28+
29+
```properties
30+
# in 20-something.conf
31+
net.ipv4.ip_forward = 0
32+
33+
# in 99-sysctl.conf
34+
net.ipv4.ip_forward = 1
35+
36+
# net.ipv4.ip_forward will be 1
37+
```
38+
39+
### Method 1: Deploy Definitively
40+
41+
By default, on most Linux distributions, the `/etc/sysctl.d/99-sysctl.conf` file is a link to the `/etc/sysctl.conf` file. Therefore, you may write the variables into the `/etc/sysctl.conf`. However, since configuration files with a file name that starts with an alphabetical character sort later in the list than `99-sysctl.conf`, the changes you make in the `/etc/sysctl.conf` might not be the final value loaded into the kernel. To make sure that your changes are loaded into the kernel, you would have to make sure that your configuration file's name is lexicographically the last file in `/etc/sysctl.d`. The filename `z-k4yt3x.conf` will be used as an example in the code snippet below.
42+
43+
This deployment method is suitable for systems that do not expect to have their sysctl configurations updated from this repository anymore. Otherwise, the configuration file's content has to be updated every time a new update form this repository is installed.
44+
45+
```shell
46+
# download the configuration file from GitHub using curl
47+
curl https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -o ~/sysctl.conf
48+
49+
# you may also download with wget or other methods if curl is not available
50+
wget https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -O ~/sysctl.conf
51+
52+
# move the configuration file into the sysctl configuration directory
53+
sudo mv ~/sysctl.conf /etc/sysctl.d/z-k4yt3x.conf
54+
55+
# make sure the file has correct ownership and permissions
56+
sudo chown root:root /etc/sysctl.d/z-k4yt3x.conf
57+
sudo chmod 644 /etc/sysctl.d/z-k4yt3x.conf
58+
```
59+
60+
### Method 2: Deploy as Template
61+
62+
Alternatively, you can use this configuration file as a template. If you name the configuration file something akin to `/etc/sysctl.d/98-k4yt3x.conf`, you may overwrite values in this configuration file by giving them a new definition the `/etc/sysctl.conf` file.
63+
64+
The advantage of doing this is that you would not have to change this template file's content every time it is updated in this repository. You can drop the template file in and make any modifications in `/etc/sysctl.conf`.
65+
66+
This method's disadvantage is that values from this template might be overwritten by values in other configurations unknowingly. For example, a `uhd-usrp2.conf` exists on my system, and overwrites the value of `net.core.rmem_max` and `net.core.wmem_max` set in previous configuration files. Packages managers can install new configurations as you install a new package or update your system. Therefore, you will have to be careful that other files do not overwrite your variables.
67+
68+
```shell
69+
# download the configuration file from GitHub using curl
70+
curl https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -o ~/sysctl.conf
71+
72+
# you may also download with wget or other methods if curl is not available
73+
wget https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -O ~/sysctl.conf
74+
75+
# move the configuration file into the sysctl configuration directory
76+
sudo mv ~/sysctl.conf /etc/sysctl.d/98-k4yt3x.conf
77+
78+
# make sure the file has correct ownership and permissions
79+
sudo chown root:root /etc/sysctl.d/98-k4yt3x.conf
80+
sudo chmod 644 /etc/sysctl.d/98-k4yt3x.conf
81+
```
82+
83+
### Method 3: Custom Order (Personal Recommendation)
84+
85+
To ensure that the configuration files are read in an order you prefer, you may also rename the files to your preference. For example, you can install this template to `/etc/sysctl.d/y-k4yt3x.conf`, then make a symbolic link from `/etc/sysctl.d/z-sysctl.conf` to `/etc/sysctl.conf`. This ensures that the two files are more likely to be read the last.
2586

2687
```shell
2788
# download the configuration file from GitHub using curl
@@ -30,21 +91,50 @@ curl https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -o ~/sys
3091
# you may also download with wget or other methods if curl is not available
3192
wget https://raw.githubusercontent.com/k4yt3x/sysctl/master/sysctl.conf -O ~/sysctl.conf
3293

33-
# backup the original sysctl.conf
34-
sudo cp /etc/sysctl.conf /etc/sysctl.conf.backup
94+
# move the configuration file into the sysctl configuration directory
95+
sudo mv ~/sysctl.conf /etc/sysctl.d/y-k4yt3x.conf
96+
97+
# make sure the file has correct ownership and permissions
98+
sudo chown root:root /etc/sysctl.d/y-k4yt3x.conf
99+
sudo chmod 644 /etc/sysctl.d/y-k4yt3x.conf
100+
101+
# point z-sysctl.conf to /etc/sysctl.conf
102+
sudo ln -s /etc/sysctl.conf /etc/sysctl.d/z-sysctl.conf
103+
```
35104

36-
# replace the old sysctl.conf with the new one
37-
sudo mv ~/sysctl.conf /etc/sysctl.conf
105+
## Loading and Verifying the Changes
38106

39-
# make sure the file has the correct ownership and permissions
40-
sudo chown root:root /etc/sysctl.conf
41-
sudo chmod 644 /etc/sysctl.conf
107+
For the changes to be effective, you will have to either reboot your machine or reload the configurations using one of the following commands.
42108

109+
```shell
43110
# instruct sysctl to load settings from the configuration file into the live kernel
44-
sudo sysctl -p
111+
# this command allows you to see the variables as they are being loaded
112+
sudo sysctl --system
113+
114+
# alternatively, you can restart the systemd-sysctl service on a system that uses systemd
115+
sudo systemctl restart systemd-sysctl
116+
117+
# procps is an alias of systemd-sysctl
118+
# restarting either one of procps and systemd-sysctl would work
119+
sudo systemctl restart procps
120+
```
121+
122+
Afterwards, you may verify your changes by dumping all kernel variables. Replace `your.config` in the following command with the name of the variable you would like to check.
123+
124+
```shell
125+
sudo sysctl -a | grep "your.config"
126+
```
127+
128+
For example, the following command prints the value of `kernel.kptr_restrict`.
129+
130+
```shell
131+
$ sudo sysctl -a | grep "kernel.kptr_restrict"
132+
kernel.kptr_restrict = 2
45133
```
46134

47-
For convenience, I have pointed the URL `https://akas.io/sysctl` to the `sysctl.conf` file. You may therefore download the `sysctl.conf` file with the following command. However, be sure to check the integrity of the file after downloading it if you choose to download using this method.
135+
## Short URL for Downloading `sysctl.conf`
136+
137+
For convenience, I have pointed the URL `https://akas.io/sysctl` to the `sysctl.conf` file. You may therefore download the `sysctl.conf` file with the following command. However, be sure to check the file's integrity after downloading it if you choose to download using this method.
48138

49139
```shell
50140
curl -sSL akas.io/sysctl -o sysctl.conf

0 commit comments

Comments
 (0)