0

I am trying to protect my server as below system variables

net.ipv4.icmp_echo_ignore_all=1
# IP Spoofing protection
​net.ipv4.conf.all.rp_filter=1
​net.ipv4.conf.default.rp_filter=1
#Ignore ICMP broadcast requests
​net.ipv4.icmp_echo_ignore_broadcasts=1
# Disable source packet routing
​net.ipv4.conf.all.accept_source_route=0
​net.ipv6.conf.all.accept_source_route=0 
​net.ipv4.conf.default.accept_source_route=0
​net.ipv6.conf.default.accept_source_route=0
# Ignore send redirects
​net.ipv4.conf.all.send_redirects=0
​net.ipv4.conf.default.send_redirects=0
# Block SYN attacks
​net.ipv4.tcp_syncookies=1
​net.ipv4.tcp_max_syn_backlog=2048
​net.ipv4.tcp_synack_retries=2
​net.ipv4.tcp_syn_retries=5
# Log Martians
​net.ipv4.conf.all.log_martians=1
​net.ipv4.icmp_ignore_bogus_error_responses=1
# Ignore ICMP redirects
​net.ipv4.conf.all.accept_redirects=0
​net.ipv6.conf.all.accept_redirects=0
​net.ipv4.conf.default.accept_redirects=0 
​net.ipv6.conf.default.accept_redirects=0
# Ignore Directed pings
​net.ipv4.icmp_echo_ignore_all=1

Image:

enter image description here

But I get some error happen when I applied the rules.

sysctl: cannot stat /proc/sys/​net/ipv4/conf/all/rp_filter: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/default/rp_filter: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/icmp_echo_ignore_broadcasts: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/all/accept_source_route: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv6/conf/all/accept_source_route: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/default/accept_source_route: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv6/conf/default/accept_source_route: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/all/send_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/default/send_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/tcp_syncookies: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/tcp_max_syn_backlog: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/tcp_synack_retries: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/tcp_syn_retries: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/all/log_martians: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/icmp_ignore_bogus_error_responses: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/all/accept_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv6/conf/all/accept_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/conf/default/accept_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv6/conf/default/accept_redirects: No such file or directory
sysctl: cannot stat /proc/sys/​net/ipv4/icmp_echo_ignore_all: No such file or directory

Error images: enter image description here

Here cat -A /etc/sysctl.conf

net.ipv4.icmp_echo_ignore_all=1$
# IP Spoofing protection$
M-bM-^@M-^Knet.ipv4.conf.all.rp_filter=1$
M-bM-^@M-^Knet.ipv4.conf.default.rp_filter=1$
#Ignore ICMP broadcast requests$
M-bM-^@M-^Knet.ipv4.icmp_echo_ignore_broadcasts=1$
# Disable source packet routing$
M-bM-^@M-^Knet.ipv4.conf.all.accept_source_route=0$
M-bM-^@M-^Knet.ipv6.conf.all.accept_source_route=0$
M-bM-^@M-^Knet.ipv4.conf.default.accept_source_route=0$
M-bM-^@M-^Knet.ipv6.conf.default.accept_source_route=0$
# Ignore send redirects$
M-bM-^@M-^Knet.ipv4.conf.all.send_redirects=0$
M-bM-^@M-^Knet.ipv4.conf.default.send_redirects=0$
# Block SYN attacks$
M-bM-^@M-^Knet.ipv4.tcp_syncookies=1$
M-bM-^@M-^Knet.ipv4.tcp_max_syn_backlog=2048$
M-bM-^@M-^Knet.ipv4.tcp_synack_retries=2$
M-bM-^@M-^Knet.ipv4.tcp_syn_retries=5$
# Log Martians$
M-bM-^@M-^Knet.ipv4.conf.all.log_martians=1$
M-bM-^@M-^Knet.ipv4.icmp_ignore_bogus_error_responses=1$
# Ignore ICMP redirects$
M-bM-^@M-^Knet.ipv4.conf.all.accept_redirects=0$
M-bM-^@M-^Knet.ipv6.conf.all.accept_redirects=0$
M-bM-^@M-^Knet.ipv4.conf.default.accept_redirects=0$
M-bM-^@M-^Knet.ipv6.conf.default.accept_redirects=0$
# Ignore Directed pings$
M-bM-^@M-^Knet.ipv4.icmp_echo_ignore_all=1$
root@ubuntu-s-2vcpu-4gb-lon1-01:/etc# 
  • Do those files exist and how are you changing these values? Please remove the spaces between the variables and = and value! – George Udosen Dec 27 '18 at 15:08
  • I did not change those I check on rp_filter file I see 1 numer value eixsting there but I don't know why I get those error messages – Heng Sopheak Dec 27 '18 at 15:13
  • Remove the spaces and see if the error goes away! Let this net.ipv4.icmp_echo_ignore_broadcasts = 1 be this net.ipv4.icmp_echo_ignore_broadcasts=1. – George Udosen Dec 27 '18 at 15:14
  • You mean remove the space between one block to another block right example: # Block SYN attacks to # Log Martians right? – Heng Sopheak Dec 27 '18 at 15:16
  • No let me post a simple answer so you can follow! And are you adding them manuallly or from a script? – George Udosen Dec 27 '18 at 15:17
2

Rather than

net.ipv4.icmp_echo_ignore_broadcasts = 1

Change each line so no spaces exists between variables and the values, like so

net.ipv4.icmp_echo_ignore_broadcasts=1
  • I update new one as you see i update the question but still the same error – Heng Sopheak Dec 27 '18 at 15:23
  • ... man sysctl.conf says "whitespace before and after a token or value is ignored" though? – steeldriver Dec 27 '18 at 15:23
  • I update error output please help to check it and those setting I try to clean space also but pass it to some text editor. – Heng Sopheak Dec 27 '18 at 15:28
  • Let me try to track down the error! – George Udosen Dec 27 '18 at 15:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.