1

I need to tweak the kernel params as the Ubuntu minimal install is created for a machine with 256 MB of ram and our server has 32 GB. The issue I am having is that when I execute the command sysctl -p /etc/sysctl.conf, the server reverts back to the original settings in under a minute.

root@mino /scripts/crons/tweaks # sysctl -p /etc/sysctl.conf
vm.swappiness = 10
vm.dirty_ratio = 60
vm.dirty_background_ratio = 2
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.core.rmem_max = 12582912
net.core.rmem_default = 31457280
net.core.wmem_default = 31457280
net.core.wmem_max = 12582912
net.core.somaxconn = 4096
net.core.netdev_max_backlog = 65536
net.core.optmem_max = 25165824
net.ipv4.tcp_rfc1337 = 1
net.ipv4.ip_local_port_range = 2000 65535
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_sack = 0
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_challenge_ack_limit = 999999999
net.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 10
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 10
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 10
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_established = 10
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 8192 87380 16777216
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 8192 65536 16777216
net.ipv4.udp_wmem_min = 16384
fs.file-max = 3500000

root@mino /scripts/crons/tweaks # /sbin/sysctl -a|grep -i nf_conntrack_max
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.em1.stable_secret"
sysctl: reading key "net.ipv6.conf.em2.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
net.netfilter.nf_conntrack_max = 10000000
net.nf_conntrack_max = 10000000

root@mino /scripts/crons/tweaks # date
Sat Jan 27 08:30:50 PST 2018

root@mino /scripts/crons/tweaks # date
Sat Jan 27 08:30:57 PST 2018

root@mino /scripts/crons/tweaks # date
Sat Jan 27 08:31:02 PST 2018

root@mino /scripts/crons/tweaks # /sbin/sysctl -a|grep -i nf_conntrack_max
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.em1.stable_secret"
sysctl: reading key "net.ipv6.conf.em2.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
net.netfilter.nf_conntrack_max = 10000000
net.nf_conntrack_max = 10000000

root@mino /scripts/crons/tweaks # date
Sat Jan 27 08:31:20 PST 2018

root@mino /scripts/crons/tweaks # /sbin/sysctl -a|grep -i nf_conntrack_max
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.em1.stable_secret"
sysctl: reading key "net.ipv6.conf.em2.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
net.netfilter.nf_conntrack_max = 65536
net.nf_conntrack_max = 65536

net.nf_conntrack_max set at 65536 is too low and a simple syn attack trips the firewall and all packets are dropped. Quite annoying. I also have the same command in my /etc/rc.local fdile and read about the debian / ubuntu bug in other threads.

Running Ubuntu 14.04 4.4.0-112-generic #135-Ubuntu SMP Fri Jan 19 11:48:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

I did research from the following sites:

sysctl.conf - tweaking for high concurrancy & security

Linux kernel tuning settings for large number of concurrent clients

Tuning TCP For The Web Presentation.pdf

0

Is the system and its /etc/sysctl.conf file under control of Puppet, SaltStack, Ansible or other similar automation tool?

If so, you'll need to make your changes through that software, because it will keep reverting any manual changes to maintain the specified configuration.

  • 1
    No it is not. There is nothing controlling the server. – Curious Sam Jan 27 '18 at 18:10
0

Your reply helped me find the answer.

I use APF firewall and in file

/etc/apf/sysctl.rules and /etc/apf/conf.apf

there are references to SYSCTL_CONNTRACK. Once these were adjusted, everything worked like a charm.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.