4

What is the right security setting for the net.ipv4.conf.all.secure_redirects option in sysctl.conf? Here it sets to 1 and Here sets to 0. Is net.ipv4.conf.default.secure_redirects related to previous? and ٌWhat is the right setting for it?

====

1st link (wiki.ubuntu.com) stated:

The following sysctl settings are default at the time of this writing. We intend that they stay this way.

net.ipv4.conf.all.secure_redirects = 1. 

Prevents hijacking of routing path by only allowing redirects from gateways known in our routing table.

2nd link (joshrendek.com) states:

# Make sure no one can alter the routing tables 
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
  • Interesting question. Though there is a slight difference in wording regarding the 2 settings. – Rinzwind Apr 17 '14 at 7:35
1

When looking at this I used Fedora as a reference (to see how another OS looks at this) (edit: these are Fedora's thoughts on setting up a SERVER! See the bottom part for why this is important):

enter image description here


Documentation:

accept_redirects - BOOLEAN
    Accept ICMP redirect messages.
    accept_redirects for the interface will be enabled if:
    - both conf/{all,interface}/accept_redirects are TRUE in the case
      forwarding for the interface is enabled
    or
    - at least one of conf/{all,interface}/accept_redirects is TRUE in the
      case forwarding for the interface is disabled
    accept_redirects for the interface will be disabled otherwise
    default TRUE (host)
        FALSE (router)

Here is an interesting blog. Conclusion:

This arcane logic means that for a non-router (i.e. most servers), not only must /proc/sys/net/ipv4/conf/all/accept_redirects be 0, but so must /proc/sys/net/ipv4/conf/interface/accept_redirects.


So ...

  • if you are using your system as a server set it to 0.
  • if you are using your system as a desktop you can leave it on 1 (but can set it to 0 if you want to harden your system).

Both can be considered correct (and sane).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.