back to labs
STIG: Harden Kernel Network Parameters (sysctl)
MediumLinux Security20-30 minThe brief
Bring this host's kernel network parameters up to the DISA STIG baseline with a persistent sysctl drop-in. Disable IPv4 forwarding, refuse and stop sending ICMP redirects, enable TCP SYN cookies, and enable full address-space layout randomization. Put the settings in a drop-in under /etc/sysctl.d/ so they persist across reboot. Grading reads the configured values the way a SCAP scan does.
What you'll do
- net.ipv4.ip_forward = 0 (no IP forwarding)
- net.ipv4.conf.all.accept_redirects = 0 (refuse ICMP redirects)
- net.ipv4.conf.all.send_redirects = 0 (do not send redirects)
- net.ipv4.tcp_syncookies = 1 (SYN flood protection)
- kernel.randomize_va_space = 2 (full ASLR)
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.