Sysctl.conf - Revision history

Arnaudv6: net.ipv4.tcp_tw_recycle has been removed from Linux in 4.12 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4396e46187

2026-04-04T13:40:02Z

net.ipv4.tcp_tw_recycle has been removed from Linux in 4.12 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4396e46187

← Older revision		Revision as of 13:40, 4 April 2026
Line 74:		Line 74:
	#vm.dirty_bytes = 4194304		#vm.dirty_bytes = 4194304

	## reuse~~/recycle~~ time-wait sockets (this is often needed on busy servers)		## reuse time-wait sockets (this is often needed on busy servers)
	net.ipv4.tcp_tw_reuse = 1		net.ipv4.tcp_tw_reuse = 1
	~~net.ipv4.tcp_tw_recycle = 1~~

	## Controls the number of syn retries (default is 6)		## Controls the number of syn retries (default is 6)

Prabuanand: added additional categories

2024-12-19T05:07:39Z

added additional categories

← Older revision		Revision as of 05:07, 19 December 2024
Line 158:		Line 158:
	</pre>		</pre>

	[[Category:Networking]]		[[Category:Networking]][[Category:Security]][[Category:Kernel]]

Gresskar: Added some security options

2024-06-12T21:01:43Z

Added some security options

@@ Line 129: / Line 129: @@
 ## Don't expose kernel memory addresses in procfs
 kernel.kptr_restrict = 2
 # Heavily restrict writing to FIFOs; they must be owned, not in sticky dirs...

Zcrayfish: /* General networking and performance */ kernel.split_lock_mitigate

2023-12-22T18:56:45Z

General networking and performance: kernel.split_lock_mitigate

← Older revision		Revision as of 18:56, 22 December 2023
Line 109:		Line 109:
	## to available memory. Set it manually below		## to available memory. Set it manually below
	#net.ipv4.tcp_max_syn_backlog = 1000		#net.ipv4.tcp_max_syn_backlog = 1000

			#Don't penalize programs for using split locks. Marginally speeds up the steam and Google Chrome flatpaks.
			kernel.split_lock_mitigate = 0
	</pre>		</pre>

Zcrayfish: /* Security */ kptr_restrict , fs.protected_fifos, fs.protected_regular

2023-12-22T18:54:15Z

Security: kptr_restrict , fs.protected_fifos, fs.protected_regular

← Older revision		Revision as of 18:54, 22 December 2023
Line 123:		Line 123:
	## this is NOT recommended, as it ignores echo requests on localhost as well		## this is NOT recommended, as it ignores echo requests on localhost as well
	#net.ipv4.icmp_echo_ignore_all = 1		#net.ipv4.icmp_echo_ignore_all = 1

			## Don't expose kernel memory addresses in procfs
			kernel.kptr_restrict = 2

			# Heavily restrict writing to FIFOs; they must be owned, not in sticky dirs...
			fs.protected_fifos = 2
			# don't allow O_CREAT open on regular files that we don't own in world/group writable sticky directories,
			# unless they are owned by the owner of the directory.
			fs.protected_regular = 2
	</pre>		</pre>

	[[Category:Networking]]		[[Category:Networking]]

Zcrayfish: /* Security */ many options no longer needed on current versions.

2023-12-22T18:40:46Z

Security: many options no longer needed on current versions.

@@ Line 112: / Line 112: @@
 = Security =
 <pre>
 ## Disable magic-sysrq key
 kernel.sysrq = 0
@@ Line 129: / Line 120: @@
 kernel.dmesg_restrict = 1
 ## optionally, ignore all echo requests
 ## this is NOT recommended, as it ignores echo requests on localhost as well
 #net.ipv4.icmp_echo_ignore_all = 1
 </pre>
 [[Category:Networking]]

Zcrayfish: /* General networking and performance */ Removed a few options that are now defaults.

2023-12-22T18:35:59Z

General networking and performance: Removed a few options that are now defaults.

← Older revision		Revision as of 18:35, 22 December 2023
Line 37:		Line 37:
	<pre>		<pre>
	### Disable routing		### Disable routing
	~~## disable ALL packet forwarding (not a router, disable it)~~
	~~net.ipv4.ip_forward = 0~~
	~~## if not functioning as a router, there is no need to accept redirects or source routes~~
	~~net.ipv4.conf.all.accept_redirects = 0~~
	~~## IP source routing (insecure, disable it)~~
	~~net.ipv4.conf.all.accept_source_route = 0~~
	## send redirects (not a router, disable it)		## send redirects (not a router, disable it)
	net.ipv4.conf.all.send_redirects = 0		net.ipv4.conf.all.send_redirects = 0
Line 102:		Line 96:
	#net.ipv4.tcp_sack = 1		#net.ipv4.tcp_sack = 1
	## tcp_fack should be on because of sack		## tcp_fack should be on because of sack
	#net.ipv4.tcp_fack ~~= 1~~		#net.ipv4.tcp_fack = 1

	~~## tcp timestamps~~
	~~## + protect against wrapping sequence numbers (at gigabit speeds)~~
	~~## + round trip time calculation implemented in TCP~~
	~~## - causes extra overhead and allows uptime detection by scanners like nmap~~
	~~## enable @ gigabit speeds~~
	~~#net.ipv4.tcp_timestamps = 0~~
	~~net.ipv4.tcp_timestamps~~ = 1

	## Set the port range used for outgoing connections		## Set the port range used for outgoing connections

Zcrayfish: /* IPv6 */ simplify list due to the defaults being changed.

2023-12-22T18:28:33Z

IPv6: simplify list due to the defaults being changed.

← Older revision		Revision as of 18:28, 22 December 2023
Line 8:		Line 8:
	Although IPv6 is [[Configure Networking\|configured]] in <code>/etc/network/interfaces</code> more advanced options are configured in <code>/etc/sysctl.conf</code>:		Although IPv6 is [[Configure Networking\|configured]] in <code>/etc/network/interfaces</code> more advanced options are configured in <code>/etc/sysctl.conf</code>:
	<pre>		<pre>
	~~## Enable IPv6 Privacy Extensions (see RFC4941 and RFC3041)~~
	~~net.ipv6.conf.default.use_tempaddr = 2~~
	~~net.ipv6.conf.all.use_tempaddr = 2~~
	~~## You should also add it explicitly per interface:~~
	~~net.ipv6.conf.eth0.use_tempaddr = 2~~

	####Turn off IPv6 Routing####		####Turn off IPv6 Routing####
	## if not functioning as a router, there is no need		## if not functioning as a router, there is no need
Line 19:		Line 13:
	net.ipv6.conf.all.accept_redirects = 0		net.ipv6.conf.all.accept_redirects = 0
	net.ipv6.conf.all.accept_source_route = 0		net.ipv6.conf.all.accept_source_route = 0
	~~## if not functioning as a router, disable packet forwarding~~
	~~net.ipv6.conf.all.forwarding = 0~~
	## Number of Router Solicitations to send until assuming no routers are present.		## Number of Router Solicitations to send until assuming no routers are present.
	## This is a host and not router		## This is a host and not router
Line 27:		Line 19:
	## Router advertisements can cause the system to assign a global		## Router advertisements can cause the system to assign a global
	## unicast address to an interface		## unicast address to an interface
	## Turn on/off below (default is 0, ~~off~~)		## Turn on/off below (default is 1, on)
	#net.ipv6.conf.default.autoconf = 0		#net.ipv6.conf.default.autoconf = 0
	## How many global unicast IPv6 addresses can be assigned to each interface?		## How many global unicast IPv6 addresses can be assigned to each interface?

Sertonix: use https

2023-08-25T21:30:58Z

use https

← Older revision		Revision as of 21:30, 25 August 2023
Line 1:		Line 1:
	{{DISPLAYTITLE:sysctl.conf}}sysctl.conf is the configuration file at <code>/etc/sysctl.conf</code> for [~~http~~://linux.die.net/man/8/sysctl sysctl] and is used to configure kernel parameters at boot time. You can load the configuration file with {{Cmd\|sysctl -p}} or simply with a reboot.		{{DISPLAYTITLE:sysctl.conf}}sysctl.conf is the configuration file at <code>/etc/sysctl.conf</code> for [https://linux.die.net/man/8/sysctl sysctl] and is used to configure kernel parameters at boot time. You can load the configuration file with {{Cmd\|sysctl -p}} or simply with a reboot.
	This article is not an exhaustive list but covers some of the main points. You may, of course, wish to change some settings to suite your environment. The config examples are well commented so should provide all the information you need. If further information is required on anything, please make a note in this page or in the 'discussion' area.		This article is not an exhaustive list but covers some of the main points. You may, of course, wish to change some settings to suite your environment. The config examples are well commented so should provide all the information you need. If further information is required on anything, please make a note in this page or in the 'discussion' area.
	Some of the options shown in the below examples may already be as default in your release. Check with <pre>sysctl -a\|grep <somestring></pre>		Some of the options shown in the below examples may already be as default in your release. Check with <pre>sysctl -a\|grep <somestring></pre>
Line 57:		Line 57:
	#net.ipv4.conf.all.log_martians = 1		#net.ipv4.conf.all.log_martians = 1

	### Memory and buffer changes. See ~~http~~://wwwx.cs.unc.edu/~sparkst/howto/network_tuning.php for more information.		### Memory and buffer changes. See https://wwwx.cs.unc.edu/~sparkst/howto/network_tuning.php {{Dead link}} for more information.
	## Increase maximum amount of memory allocated to shm		## Increase maximum amount of memory allocated to shm
	#kernel.shmmax = 1073741824		#kernel.shmmax = 1073741824

ITux: Removed double entry for 'net.ipv4.conf.all.accept_source_route'

2022-03-09T04:03:17Z

Removed double entry for 'net.ipv4.conf.all.accept_source_route'

← Older revision		Revision as of 04:03, 9 March 2022
Line 49:		Line 49:
	## if not functioning as a router, there is no need to accept redirects or source routes		## if not functioning as a router, there is no need to accept redirects or source routes
	net.ipv4.conf.all.accept_redirects = 0		net.ipv4.conf.all.accept_redirects = 0
	~~net.ipv4.conf.all.accept_source_route = 0~~
	## IP source routing (insecure, disable it)		## IP source routing (insecure, disable it)
	net.ipv4.conf.all.accept_source_route = 0		net.ipv4.conf.all.accept_source_route = 0