UNIX03/Kernel Protocol Switches

 /proc/sys/net/ipv4

Take a look at the files in there now.

All of these files may be viewed with less or cat. Many of these pseudo-files may be written to, to alter the settings in a running kernel. Those than can be written to usually accept either a '0' for disable or '1' for enable. Because /proc is not on-disk, the file system will revert back to the defaults when the system is rebooted. On Red Hat, Mandrake, and Slackware, you can place the respective commands to set these values in

 /etc/rc.d/rc.local

In other distributions, you will find some variant the /etc/rc?.d which you can create a new script in /etc/init.d and symlink it into the various /etc/rc?.d directories (for example Gentoo and Debian).

The most important setting to enable is having your system not respond to broadcast ICMP broadcasts. By setting this, you will block the use of your system in a very popular DDoS? (Distributed Denial of Service) attack.

To block this exploit issue the following command

 # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

You can also have your system ignore all ICMP echo requests with the following

 # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

There are many other useful configuration files in this directory for limitting exploits and DoS attacks.

(C) Copyright 2003 Samuel Hart

This work is licensed under a Creative Commons License.