Arch Linux

tessio

Member

Registered: 2011-02-06

Posts: 6

Linux Hardening and /proc Filesystem Question

Hello,
I reading about Linux hardening, but when it comes to kernel parameters configuration I have a small doubt.

Some tutorials tell you to change kernel network options this way:
echo 1 > /proc/sys/net/ipv4/conf /all/rp_filter

others, this way:
echo 1 > /proc/sys/net/ipv4/conf /default/rp_filter

and others tell you to to change both ways:
echo 1 > /proc/sys/net/ipv4/conf /all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf /default/rp_filter

What is the difference, and what is the correct way to change kernel network options?

esdaniel

Member

From: Paris

Registered: 2010-02-01

Posts: 59

Website

Re: Linux Hardening and /proc Filesystem Question

YMMV i.e. depending on your configuration.

*all* All and any future interfaces configured
*default* - your default interface
*eth/br/etc[0-n]* - a specific interface

Background articles:
http://www.shorewall.net/Anti-Spoofing.html
http://linuxgazette.net/issue77/lechnyr.html

I have mine set using *all* and I run vms & lxc containers over a single bridged interface without issue.

tessio

Member

Registered: 2011-02-06

Posts: 6

Re: Linux Hardening and /proc Filesystem Question

But.. what NIC is my default? The NIC that connect to my default gateway?

Interesting to note those lines from ubuntu's sysctl.conf, where they set the parameter in both directories:
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

The same occurs in LFS:
# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter

If all means *all*, why it must be set in default too?

Last edited by tessio (2012-07-26 18:06:17)

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: Linux Hardening and /proc Filesystem Question

rp_filter - INTEGER
[..snip..]
The max value from conf/{all,interface}/rp_filter is used when doing source validation on the {interface}.

I have not tested it, but given that your assumption is correct. "default" (NIC with your default route) would not be needed as well if "all" is set to 1.
But you could overwrite the setting of "all" with default="2" (also a valid setting, but not recommended).

tessio

Member

Registered: 2011-02-06

Posts: 6

Re: Linux Hardening and /proc Filesystem Question

Where can I find documentation about the precedence of one directory over another?

Last edited by tessio (2012-07-28 00:41:24)

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: Linux Hardening and /proc Filesystem Question

I'm not sure I understand your question, but my quote is from the linux kernel source documentation. Just install this to get it.
Rephrase your question please, if you did not mean that.

tessio

Member

Registered: 2011-02-06

Posts: 6

Re: Linux Hardening and /proc Filesystem Question

My question was bout the precedence each directory in "/proc/sys/net/ipv4/conf/*" has over the other. For example, if a set:

echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

What will be the rp_filter value for eth0 (that is also the default NIC)?

linux-docs installs a bunch of files.. could you direct me to the one that cover this specific topic? Thanks!

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: Linux Hardening and /proc Filesystem Question

The value should be 2 (the max value) then according to the docs:

cat /usr/src/linux-3.4.6-1-ARCH/Documentation/networking/ip-sysctl.txt

Have a look in that directory also, good other reads in there for you without any doubt.

tessio

Member

Registered: 2011-02-06

Posts: 6

Re: Linux Hardening and /proc Filesystem Question

For testing purpose, I set

net.ipv4.conf.eth0.rp_filter=0
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=2

them rebooted the machine, and finally..

$cat /proc/sys/net/ipv4/conf/eth0/rp_filter 
0

so, apparently, the max value priority is a documentation error.. 'interface' has priority over everything.

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: Linux Hardening and /proc Filesystem Question

Interesting.
In fact I like that, because only that way an explicit setting for an interface smaller than the default is possible.
Still, the documentation is wrong apparently, as you note.
You dont have to reboot to test new parameters by the way:

sysctl --system

reloads the configs at runtime.