Bug#572712: use hardened sysctl net.* settings per default

2024-07-14 Thread Christoph Anton Mitterer
Hey Ben. Nice to see a package for that :-) On Tue, 2024-06-25 at 00:46 +0200, Ben Hutchings wrote: > > net.ipv4.conf.all.rp_filter=1 > > This is (effectively) set to 2 by the new configuration. Just wondered why not using 1? AFAIU, the RFC would recommend strict mode (1). Does that break anyth

Bug#572712: use hardened sysctl net.* settings per default

2024-06-24 Thread Ben Hutchings
Control: reassign -1 linux-sysctl-defaults 4.10 Control: tag -1 moreinfo Better late than never: we now have a package providing a default sysctl configuration file, which will (soon) be added to Depends or Recommends of systemd and procps. You wrote: > I think it would be a good idea to use at l

Bug#572712: use hardened sysctl net.* settings per default

2010-07-10 Thread Bastian Blank
reassign 572712 linux-2.6 thanks On Sat, Jul 10, 2010 at 02:37:36PM +0200, Moritz Muehlenhoff wrote: > If you want to change the standard Debian sysctl settings, this should > probably be changed by netbase providing a /etc/sysctl.d snippet. We are over this. This is kernel config, not the config

Bug#572712: use hardened sysctl net.* settings per default

2010-07-10 Thread Julien Cristau
On Sat, Jul 10, 2010 at 13:45:44 +0100, Julien Cristau wrote: > On Sat, Jul 10, 2010 at 14:37:36 +0200, Moritz Muehlenhoff wrote: > > > If you want to change the standard Debian sysctl settings, this should > > probably be changed by netbase providing a /etc/sysctl.d snippet. > > > > The kernel

Bug#572712: use hardened sysctl net.* settings per default

2010-07-10 Thread Julien Cristau
On Sat, Jul 10, 2010 at 14:37:36 +0200, Moritz Muehlenhoff wrote: > If you want to change the standard Debian sysctl settings, this should > probably be changed by netbase providing a /etc/sysctl.d snippet. > > The kernel package is not the right place. Reassigning to netbase. > Can you explain

Bug#572712: use hardened sysctl net.* settings per default

2010-07-10 Thread Moritz Muehlenhoff
reassign 572712 netbase thanks On Mon, May 31, 2010 at 06:29:15PM +0200, Christoph Anton Mitterer wrote: > Hi Moritz, et al. > > On Sun, 2010-05-30 at 19:29 +0200, Moritz Muehlenhoff wrote: > > If you want to modify kernel defaults you'll need to discuss the > > specific options with upstream, we

Bug#572712: use hardened sysctl net.* settings per default

2010-05-31 Thread Christoph Anton Mitterer
Hi Moritz, et al. On Sun, 2010-05-30 at 19:29 +0200, Moritz Muehlenhoff wrote: > If you want to modify kernel defaults you'll need to discuss the > specific options with upstream, we won't differ in the Debian kernel > configuration. I don't want to change the kernel defaults... For the Debian ke

Bug#572712: use hardened sysctl net.* settings per default

2010-05-30 Thread Moritz Muehlenhoff
On Sun, Mar 07, 2010 at 10:11:11AM +1100, Craig Small wrote: > On Fri, Mar 05, 2010 at 09:25:49PM +0100, Christoph Anton Mitterer wrote: > > I think it would be a good idea to use at least the settings blow per > > default: > You're asking in the wrong place then. To change the default behaviour >

Bug#572712: use hardened sysctl net.* settings per default

2010-03-06 Thread Christoph Anton Mitterer
On Sun, 2010-03-07 at 10:11 +1100, Craig Small wrote: > On Fri, Mar 05, 2010 at 09:25:49PM +0100, Christoph Anton Mitterer wrote: > > I think it would be a good idea to use at least the settings blow per > > default: > You're asking in the wrong place then. To change the default behaviour > of the

Bug#572712: use hardened sysctl net.* settings per default

2010-03-06 Thread Craig Small
On Fri, Mar 05, 2010 at 09:25:49PM +0100, Christoph Anton Mitterer wrote: > I think it would be a good idea to use at least the settings blow per > default: You're asking in the wrong place then. To change the default behaviour of the kernel, you need to apply this bug to the kernel, not procps.

Bug#572712: use hardened sysctl net.* settings per default

2010-03-05 Thread Christoph Anton Mitterer
Package: procps Version: 1:3.2.8-7 Severity: wishlist Hi. I think it would be a good idea to use at least the settings blow per default: net.ipv4.conf.all.rp_filter=1 net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.a