Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm following a security guide(http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics) to strengthen my OpenVZ based VPS webserver running Ubuntu 12.04 , a part of that asks to make some modifications to sysctl.conf. But I am not sure if all that really makes sense in an openVZ container, as it is a shared kernel.

Here are the edits that are suggested for sysctl.conf

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1

When I tried to test these with my OpenVZ container I got permission denied for 3 of these entries which probably have been locked down by my host.

error: permission denied on key 'net.ipv4.tcp_max_syn_backlog'
error: permission denied on key 'net.ipv4.tcp_synack_retries'
error: permission denied on key 'net.ipv4.tcp_syn_retries'

Now my question is: Does it really make sense to include these to my sysctl.conf in an openVZ container environment ? I want to tighten security on my server but I am not really sure if they would take effect in my openVZ container.

share|improve this question

1 Answer 1

OpenVZ has the kernel that is shared between host and all containers, thus settings that might affect other containers and host are prohibited from modifications from inside a container. You can try to change these denied settings on host, they might be applied to all containers (OpenVZ kernel controls what is and what's not applied)

This has been also answered here: http://superuser.com/questions/659236/permission-denied-when-setting-values-in-sysctl-on-ubuntu-12-04

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.