To secure the kernel, what can I modify in /etc/sysctl.conf?

Question

I want to make my Linux machine a web server. I am looking to secure the kernel by applying changes to /etc/sysctl.conf. I will first describe to you what my web app will be about.

The app will be a classified ads website (like gumtree.co.uk) where users can:

-sell their items, upload images, send to and receive emails from the admin. 
-It will use SSL for some pages. I will also need SSH.

In /etc/sysctl.conf, I get all those options to uncomment, but I don't know which ones I can uncomment to secure the kernel more and serve my web hosting purposes at the same time.

Here are the different options:

1) Turn on Source Address Verification in all interfaces to prevent spoofing attacks
2) Uncomment the next line to enable packet forwarding for IPv4
3) Uncomment the next line to enable packet forwarding for IPv6
4) Do no accept ICMP redirects (we are not a router)
5) Accept ICMP redirects only for gateways listed in our default gateway list
6) Do not send ICMP redirects
7) Do not accept IP source route packets (we are not a router)
8) Log Martian Packets

Which ones can I uncomment? Also, is there something else you suggest in order to secure the kernel?

Thanks a lot. Regards

Answer 1

The short answer, I would focus on the firewall first, but then I would turn on options 2,3,7. You will have a relatively secure server by not changing any of them, however 2,3,7 should be safe to change.

You are trying to do a good thing by tightening security on the kernel, however you will get more mileage out of having other things in place first. If you ware worried about security the first thing you should have in place is a firewall that blocks all incoming connections except web traffic (80 and 443) and SSH from wherever is appropriate (22).

In order to attack the kernel they need to be able to connect to your server, whether that is sending stuffed packets to apache, or brute forcing your ssh password. Limiting these attack vectors is the first thing to do. If you dont have a hardware firewall all major distributions come with one, iptables for centos/rhel or ufw for ubuntu for example.

With that in place... For the most part the kernel is secure out of the box. The sysctl options are described in greater depth here: http://www.mjmwired.net/kernel/Documentation/sysctl/kernel.txt. I manage 300+ servers and generally avoid using sysctl.conf for security and normally only use it for traffic tuning.