Tag Info

Hot answers tagged

8

I'd recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through. Follow-Up Note: RSA (one of the world's leading security technology companies) was hacked recently when ...


5

Security privileges security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 security.bsd.conservative_signals=1 security.bsd.unprivileged_proc_debug=0 security.bsd.unprivileged_read_msgbuf=0 security.bsd.hardlink_check_uid=1 security.bsd.hardlink_check_gid=1 vfs.usermount=0 net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1


5

From the default sysctl.conf, it provides "security" against script kiddies who manage to brute their way in on a non-root account. Doesn't hurt to have it enabled (in most cases, exceptions are non-privileged daemons needing to see the process list). # Uncomment this to prevent users from seeing information about processes that # are being run under ...


4

i usually add followings to my /etc/sysctl.conf as well... net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 and both of security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 while we're on tunning subject i'd also recommend to take a look here:NGINX + PHP-FPM + APC = Awesomeso, this tutorial on FreeBSD + that tutorial on NGINX = Really ...


3

I believe /etc/sysctl.conf is still the right place (and man sysctl.conf agrees). Did you reboot? changes to /etc/sysctl.conf are not a real-time thing: They are only read/applied when the system enters multi-user mode during startup.


2

The location is still /etc/sysctl.conf or more precisely /private/etc/sysctl.conf. I had to tweak some settings because I wanted to run Postgresql on my machine and it turned out that I had to modify all of the five settings in order to get it running. So I created the file and put in something like this: kern.sysv.shmmax=1610612736 kern.sysv.shmmin=1 ...


2

I'd be surprised if your installation of Ubuntu didn't have by default more than 65536 available. Check your current setting with $ sudo sysctl fs.file-max The general rule of thumb is that you can increase the fs.file-max parameter by 64 for every 1MB of RAM. e.g. 2 gigabytes = 2048 * 1MB = 2048 * 64 = 131072 ...


2

You do realise that Fedora isn't FreeBSD, don't you? To do something similar to this in a Linux distribution, just set the policy on your firewall to be DROP.


1

The only real way to get all kinds of information about kernel parameters is to read the includes that those variables come from, in Mac OS X the list starts with sys/sysctl.h: definitions for top level identifiers, second level kernel and hardware identifiers, and user level identifiers sys/socket.h: definitions for second level network ...


1

Well, it's saying that you have a setting net.netfilter.nf_conntrack_acct in your /etc/sysctl.conf, but when sysctl tries to load that setting it has no idea what it is. Did this used to work in the past? Maybe you installed a new kernel which does not support that sysctl. EDIT: based on your comment about the kernel version you are using, it looks like ...



Only top voted, non community-wiki answers of a minimum length are eligible