修改内核配置文件- vim /etc/sysctl.conf
刷新配置文件- sysctl -p
关ipv6- net.ipv6.conf.all.disable_ipv6 = 1
- net.ipv6.conf.default.disable_ipv6 = 1
避免放大攻击- net.ipv4.icmp_echo_ignore_broadcasts = 1
开启恶意的icmp错误消息保护- net.ipv4.icmp_ignore_bogus_error_responses = 1
关闭路由转发- net.ipv4.ip_forward = 0
- net.ipv4.conf.all.send_redirects = 0
- net.ipv4.conf.default.send_redirects = 0
开启反向路径过滤- net.ipv4.conf.all.rp_filter = 1
- net.ipv4.conf.default.rp_filter = 1
处理无源路由的包- net.ipv4.conf.all.accept_source_route = 0
- net.ipv4.conf.default.accept_source_route = 0
关sysrq功能- kernel.sysrq = 0
core文件名添加pid作为扩展名- kernel.core_uses_pid = 1
开SYN洪水攻击保护- net.ipv4.tcp_syncookies = 1
修改消息队列长度- kernel.msgmnb = 65536
- kernel.msgmax = 65536
设置最大内存共享段大小bytes- kernel.shmmax = 68719476736
- kernel.shmall = 4294967296
timewait的数量默认为180000- net.ipv4.tcp_max_tw_buckets = 6000
- net.ipv4.tcp_sack = 1
- net.ipv4.tcp_window_scaling =
本文出处： https://birdteam.net/132951
| 
注册
登录
