1

Using Lubuntu 18.10 Cosmic Cuttlefish

Most commands do stick. However Lynis has repeatedly demonstrated four sysctl parameters are not sticking on reboot. sysctl -p does successfully apply them after the system has started.

fs.suid_dumpable=0 (still haven't figured this out)
net.ipv4.conf.all.rp_filter=1 (Wireguard VPN overruled this; see source 1 below)
net.ipv4.conf.all.log_martians=1 (/etc/ufw/sysctl.conf overruled this)
net.ipv4.conf.default.log_martians=1 (/etc/ufw/sysctl.conf overruled this)

Source 1

The one I am most concerned about is net.ipv4.conf.all.rp_filter, which should be set to 1, but is set to 0... leaving the machine vulnerable to ip spoofing. How can I ensure these are set properly upon boot? Note update: this is disabled automatically by VPN's like Wireguard (possibly openvpn/others) so not to drop legit packets, see source above for details. Disabling Wireguard VPN sysctl boot command resulted in fp_filter=1 working as intended, potentially causing issues for Wireguard. Lynis False positive, I will leave this disabled for functionality. Warning disabling Wireguard after boot does not (as of yet) revert this to the safe setting. sysctl -p required.

Location of all sysctl.conf files via find / -name '*sysctl*.conf'

/usr/share/doc/procps/examples/sysctl.conf
/snap/core/6405/etc/sysctl.conf
/snap/core/6405/etc/sysctl.d/99-sysctl.conf
/snap/core18/719/etc/sysctl.d/99-sysctl.conf
/etc/sysctl.conf
/etc/ufw/sysctl.conf
/etc/sysctl.d/99-sysctl.conf
  • @please, that the name of the distribution – c4f4t0r Feb 18 at 14:11
  • Lubuntu 18.10 Cosmic Cuttlefish – tutudid Feb 18 at 14:32
  • In case you can't find it, try grep -rHin fs.suid_dumpable /etc. Looks like as this is overridden as well. Eventually also grep on /lib/systemd. – hargut Feb 18 at 19:20
  • That is one of the most convenient commands I have ever seen in linux, I was wondering if there was a way to search globally inside files for lines; I just wasn't expecting it to happen in mere milliseconds. Amazing! Thank you. Unfortunately it never found what was overruling this setting in those locations. – tutudid Feb 18 at 20:11
1

Create a file /etc/sysctl.d/local.conf containing the values you want.

fs.suid_dumpable=0
net.ipv4.conf.all.log_martians=1 
net.ipv4.conf.all.rp_filter=1     
net.ipv4.conf.default.log_martians=1  

Reboot.

The scripts load any *.conf files from several directories, in file name collation order. See the sysctl --system option in the man page for the search paths.

In particular, check that any values are not already defined in /etc/sysctl.conf. Consider moving values you want to keep from it to sysctl.d, then removing that file.

  • It is sysctl.d, I had systemd style paths on the mind. Fixed. – John Mahowald Feb 18 at 15:00
  • thank you, so etc/sysctl.d.conf/ may be the location for some users? – tutudid Feb 18 at 15:03
  • Added the lines to /local.conf, rebooted, tis did not work for me. Upon reboot those 4 settings are set to default. Feel free to exit/update your suggestion. – tutudid Feb 18 at 15:08
  • I do not see all.rp_filter listed under, /proc/sys/net/ipv4, is this why? – tutudid Feb 18 at 15:13
  • Edit your question and add the contents of every file found by this pattern: find / -name '*sysctl*.conf' – John Mahowald Feb 18 at 15:13

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.