draft The Linux kernel is at the heart of every Linux system. With its extensive configuration options, it comes to no surprise that specific settings can be enabled to further harden your system. In this guide, we focus on Linux kernel configuration entries that support additional hardening of your system, as well as the configuration through the syctl settings. 1 Profile matching all standard (vanilla-kernel) hardening rules sysctl net.ipv4.ip_forward must be 0 echo 0 > /proc/sys/net/ipv4/ip_forward sysctl net.ipv4.tcp_syncookies must be 1 echo 1 > /proc/sys/net/ipv4/tcp_syncookies sysctl net.ipv6.conf.all.forwarding must be 0 echo 0 > /proc/sys/net/ipv6/conf/all/forwarding sysctl net.ipv6.conf.default.forwarding must be 0 echo 0 > /proc/sys/net/ipv6/conf/default/forwarding kernel config CONFIG_SYN_COOKIES must be y file /etc/login.defs must have a line that matches ^PASS_MAX_DAYS.*99999 file /etc/login.defs must have a line that matches ^PASS_MIN_DAYS.*0 file /etc/login.defs must have a line that matches ^PASS_WARN_AGE.*7 file /etc/pam.d/common-password must have a line that matches minlen=6 file /etc/pam.d/common-password must have a line that matches remember= file /etc/login.defs may not have a line that matches ^FAIL_DELAY.*0 file /etc/login.defs must have a line that matches ^FAIL_DELAY file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_REMOTE_ACCESS.*no file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no file /etc/login.defs must have a line that matches ^UID_MIN.*1000 file /etc/login.defs must have a line that matches ^UID_MAX.*60000 file /etc/login.defs must have a line that matches ^GID_MIN.*1000 file /etc/login.defs must have a line that matches ^GID_MAX.*60000 sysctl kernel.sysrq must be 0 echo 0 > /proc/sys/kernel/sysrq file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=md5 file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=des file /etc/sysconfig/security must have a line that matches ^CHECK_PERMISSIONS.*set file /etc/sysconfig/security must have a line that matches ^CHECK_SIGNATURES.*yes file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_CHROOTED.*yes file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_AS.*dhcpd file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_CHROOTED.*yes file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_AS.*dhcpd file /etc/sysconfig/services must have a line that matches ^DISABLE_RESTART_ON_UPDATE.*yes file /etc/sysconfig/services must have a line that matches ^DISABLE_STOP_ON_REMOVAL.*yes