##############################################################
# KERNEL HARDENING
##############################################################

# Enable ASLR (Address Space Layout Randomization)
# Randomizes memory addresses, making exploitation harder
# 2 = full randomization
kernel.randomize_va_space = 2

# Restrict kernel dmesg access to root
# Hides kernel memory addresses from unprivileged users
kernel.dmesg_restrict = 1

# Restrict access to kernel pointers in /proc
# Hides kernel memory addresses shown in /proc/kallsyms, /proc/modules
kernel.kptr_restrict = 2

# Disable kernel profiling (hides kernel internals from non-root)
kernel.perf_event_paranoid = 3

# Disable kernel magic SysRq key
# Prevents direct kernel reboots/crashes via keyboard
kernel.sysrq = 0

# Restrict use of ptrace to direct parent processes (reduces ptrace abuse)
# 1 = restricted, 2 = admin only, 3 = disabled
kernel.yama.ptrace_scope = 1

# Disable BPF JIT for non-root users (reduces JIT spraying attacks)
kernel.unprivileged_bpf_disabled = 1
net.core.bpf_jit_harden = 2

##############################################################
# NETWORK STACK HARDENING
##############################################################

# Disable IP forwarding (enable ONLY if this is a router)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Disable source routing (packets should not dictate their own path)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable reverse path filtering (prevents IP spoofing)
# Drops packets with source addresses that are unreachable via the incoming interface
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP redirects (attackers use these to redirect traffic)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable TCP SYN cookies (prevents SYN flood DoS attacks)
net.ipv4.tcp_syncookies = 1

# Ignore ICMP broadcast requests (Smurf attack prevention)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus error messages
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Log martian packets (packets with impossible source addresses)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Disable secure ICMP redirects (ICMP redirects from gateways)
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

# Increase TCP connection limits for busy servers
net.ipv4.tcp_max_syn_backlog = 2048

# Reduce TIME_WAIT sockets for faster recovery
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1

# Disable IPv6 if not needed (reduces attack surface)
# Comment out if you use IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

# Restrict local port range
net.ipv4.ip_local_port_range = 32768 60999

##############################################################
# FILE SYSTEM HARDENING
##############################################################

# Restrict core dump files (prevents credential leaks from crashed processes)
fs.suid_dumpable = 0

# Protect hardlinks and symlinks from privilege escalation
fs.protected_hardlinks = 1
fs.protected_symlinks = 1

# Restrict /proc/PID/ to process owner
fs.protected_fifos = 2
fs.protected_regular = 2