Using Lubuntu 18.10 Cosmic Cuttlefish
Most commands do stick. However Lynis has repeatedly demonstrated four sysctl parameters are not sticking on reboot. sysctl -p does successfully apply them after the system has started.
fs.suid_dumpable=0 (still haven't figured this out) net.ipv4.conf.all.rp_filter=1 (Wireguard VPN overruled this; see source 1 below) net.ipv4.conf.all.log_martians=1 (/etc/ufw/sysctl.conf overruled this) net.ipv4.conf.default.log_martians=1 (/etc/ufw/sysctl.conf overruled this)
The one I am most concerned about is
net.ipv4.conf.all.rp_filter, which should be set to 1, but is set to 0... leaving the machine vulnerable to ip spoofing. How can I ensure these are set properly upon boot? Note update: this is disabled automatically by VPN's like Wireguard (possibly openvpn/others) so not to drop legit packets, see source above for details. Disabling Wireguard VPN sysctl boot command resulted in fp_filter=1 working as intended, potentially causing issues for Wireguard. Lynis False positive, I will leave this disabled for functionality. Warning disabling Wireguard after boot does not (as of yet) revert this to the safe setting.
sysctl -p required.
Location of all sysctl.conf files via
find / -name '*sysctl*.conf'
/usr/share/doc/procps/examples/sysctl.conf /snap/core/6405/etc/sysctl.conf /snap/core/6405/etc/sysctl.d/99-sysctl.conf /snap/core18/719/etc/sysctl.d/99-sysctl.conf /etc/sysctl.conf /etc/ufw/sysctl.conf /etc/sysctl.d/99-sysctl.conf