Hardening the Linux kernel via sysctl is one of the most effective ways to establish a rock-solid edge defense. By tweaking runtime kernel parameters in /etc/sysctl.conf (or inside /etc/sysctl.d/), you can block common network attacks, prevent information leaks, and protect system memory from exploitation without needing to recompile the kernel.

Here is a comprehensive production guide for hardening the kernel, organized by attack surface.

1. Network Defense & Anti-Spoofing

These settings harden the TCP/IP stack against common automated attacks like blind spoofing, source routing exploits, and SYN flood denial-of-service attempts.

# Ignore ICMP echo requests (pings) to prevent network discovery
net.ipv4.icmp_echo_ignore_all = 1
net.ipv6.icmp.echo_ignore_all = 1

# Ignore broadcast ICMP requests to prevent Smurf DoS attacks
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus ICMP error responses
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable SYN Cookies to mitigate SYN Flood DoS attacks
net.ipv4.tcp_syncookies = 1

# Drop source-routed packets (prevent traffic routing manipulation)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable Reverse Path Filtering to prevent IP spoofing
# Forces the kernel to validate the source address of packets received
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Log packets with impossible source addresses (martians) for edge auditing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Do not accept ICMP redirects (prevents MITM route hijacking)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects (this machine is a host, not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

2. File System Security & Link Restrictions

To block local privilege escalation attacks, you should restrict how the kernel handles hard links and symbolic links (symlinks) in shared, world-writable directories like /tmp.

# Restrict symlink creation: regular users cannot follow symlinks 
# owned by other users in world-writable directories
fs.protected_symlinks = 1

# Restrict hard link creation: prevents users from creating links 
# to files they do not own or have read/write access to
fs.protected_hardlinks = 1

# Restrict protected FIFOs and regular files in world-writable directories
fs.protected_fifos = 2
fs.protected_regular = 2

3. Memory & Kernel Information Leak Protection

Attackers often look for patterns in kernel memory addresses to build reliable exploits (like buffer overflows). These settings hide kernel indicators and randomize memory layouts.

# Enforce Address Space Layout Randomization (ASLR)
# 2 randomizes the stack, virtual dynamic shared object (vDSO) page, shared memory, and data segments
kernel.randomize_va_space = 2

# Restrict access to kernel logs (dmesg) to root users only
# Prevents unprivileged users from spotting kernel memory addresses or hardware flaws
kernel.dmesg_restrict = 1

# Restrict access to the kernel profiling subsystem (perf_event)
kernel.perf_event_paranoid = 3

# Restrict the use of eBPF to privileged users to mitigate speculative execution side-channel attacks
kernel.unprivileged_bpf_disabled = 1

# Disable the kernel pointer extension in /proc files to hide actual memory addresses
kernel.kptr_restrict = 2

4. Implementation Workflow

Step 1: Create a Dedicated Hardening File

Instead of modifying the core /etc/sysctl.conf directly, it is cleaner to use the modular .d directory. Create a custom configuration file:

sudo nano /etc/sysctl.d/99-security-hardening.conf

Paste the configurations above into this file and save it.

Step 2: Validate and Apply Changes

To load and apply the new configuration immediately without rebooting the system, run:

sudo sysctl --system

Step 3: Verify Specific Parameters

If you want to verify that a specific rule was successfully applied, query it directly with sysctl:

sysctl kernel.randomize_va_space

Warning: Test these configurations in a staging or dev environment first. For instance, disabling ICMP echo requests (icmp_echo_ignore_all = 1) will break standard network ping diagnostics, which might conflict with internal uptime monitoring setups.