1

I'm following a security guide(http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics) to strengthen my OpenVZ based VPS webserver running Ubuntu 12.04 , a part of that asks to make some modifications to sysctl.conf. But I am not sure if all that really makes sense in an openVZ container, as it is a shared kernel.

Here are the edits that are suggested for sysctl.conf

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1

When I tried to test these with my OpenVZ container I got permission denied for 3 of these entries which probably have been locked down by my host.

error: permission denied on key 'net.ipv4.tcp_max_syn_backlog'
error: permission denied on key 'net.ipv4.tcp_synack_retries'
error: permission denied on key 'net.ipv4.tcp_syn_retries'

Now my question is: Does it really make sense to include these to my sysctl.conf in an openVZ container environment ? I want to tighten security on my server but I am not really sure if they would take effect in my openVZ container.

1 Answer 1

2

Already answered on superuser.com:

there is only a single kernel running for both the host and all "VPS"es

For security reasons the openVZ container will not allow you to change any shared setting that may impact the host server, but the settings in the host server - at least many of them - will affect all containers.
If you receive access denied your settings are ignored for security reasons.
A good host server will have security measures that will prevent common kernel level vulnerabilities from affecting your container; in a shared enviroment, always notify the admin if you find bad or not safe settings (he will be happy, don't worry)!
You are still allowed to configure iptables firewall (official guide) in your container: it will block a good range of attacks!
If you have other questions feel free to answer by commenting under here and don't forget to press the UP arrow and set as favorite if I'm of any help.

Good afternoon.

2
  • Could you please clarify about these: 1.) Are all of the sysctl.conf settings related to kernel? 2.) I can see some of the values I set into sysctl were accepted. How come my values could be enforeced on shared kernel ? 3.) Should I as a openVZ container user for my webserver should not bother about making modifications to sysctl.conf rather keep the settings set by host? Mar 13, 2014 at 15:14
  • 1) Yes, the sysctl interface changes the kernel parameters, immediately if possible. 2) It depends on the OpenVZ kernel version; in any case you will not be able to annoy the other machines, it there isn't a security flaw; do as many changes you want but you have no guarantee that they will have an effect. You've bought the VPN with a fixed set of settings. If you need different settings, I suggest to ask to the server admin. 3) You should not edit your sysctl, the OpenVZ kernel has a conservative and stable kernel: wiki.openvz.org/Security . Feel free to ask if you have more doubts. Mar 13, 2014 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .