https://futex.re/mediawiki/index.php?action=history&feed=atom&title=8.1_Tips 2026-04-22T18:48:22Z Historique des versions pour cette page sur le wiki MediaWiki 1.39.17 https://futex.re/mediawiki/index.php?title=8.1_Tips&diff=1744&oldid=prev 2012-09-15T15:28:28Z

<p></p> <p><b>Nouvelle page</b></p><div>Rendre la pile non executable dans /etc/system:<br /> noexec_user_stack=1<br /> <br /> Il faut passer le champ tcp_strong_iss à 2 (par défaut il est à 1, on peut prévoir le numéro de séquence TCP) <br /> ndd -set /dev/tcp tcp_strong_iss 2<br /> To configure this behavior to be the default after future reboots, put the line TCP_STRONG_ISS=2 in the file /etc/default/inetinit<br /> <br /> Disable ICMP broadcast echo activity. Otherwise, your system could be used as part of a Smurf attack:<br /> ndd -set /dev/ip ip_respond_to_echo_broadcast 0<br /> ndd -set /dev/ip ip6_respond_to_echo_multicast 0<br /> ndd -set /dev/ip ip_forward_directed_broadcasts 0<br /> <br /> Disable ICMP routing redirects. <br /> ndd -set /dev/ip ip_ignore_redirect 1<br /> ndd -set /dev/ip ip6_ignore_redirect 1<br /> ndd -set /dev/ip ip_send_redirects 0<br /> ndd -set /dev/ip ip6_send_redirects 0<br /> <br /> Disable ICMP broadcast probes.<br /> ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0<br /> ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 <br /> <br /> Disable IP source routing. <br /> ndd -set /dev/ip ip_forward_src_routed 0<br /> ndd -set /dev/ip ip6_forward_src_routed 0 <br /> <br /> Enforce strict multi-homing for non-forwarding multi-homed systems.<br /> ndd -set /dev/ip ip_strict_dst_multihoming 1<br /> ndd -set /dev/ip ip6_strict_dst_multihoming 1 <br /> <br /> Increase resiliance under heavy TCP load (which makes the system more resistant to SYN Flood attacks).<br /> ndd -set /dev/tcp tcp_conn_req_max_q 1024<br /> ndd -set /dev/tcp tcp_conn_req_max_q0 4096<br /> ndd -set /dev/tcp tcp_time_wait_interval 60000 <br /> <br /> Defend against TCP connection hijacking by following the recommendations of RFC 1948.<br /> ndd -set /dev/tcp tcp_strong_iss 2<br /> To configure this behavior to be the default after future reboots, put the line TCP_STRONG_ISS=2 in the file /etc/default/inetinit<br /> <br /> Increase TCP send and receive window sizes to at least 32 kbytes.<br /> ndd -set /dev/tcp tcp_xmit_hwat 32768<br /> ndd -set /dev/tcp tcp_recv_hwat 32768</div>

Futex