/etc/sysctl.d/99-security.conf
/etc/sysctl.d/99-security.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
sysctl -p /etc/sysctl.d/99-security.conf验证
验证
sysctl net.ipv4.tcp_syncookies net.ipv4.conf.all.accept_redirects
sysctl --system | head # 载入全部配置并观察输出网关、容器主机与开启转发的主机 ip_forward 必须为 1；加固前先确认主机角色，避免照抄模板。