Linux sysctl & SSH Hardening Config Generator — Interactive Security Tool

[ 1. WORKLOAD PRESET PROFILE ]

Select an architectural preset to automatically populate optimal kernel and daemon baselines:

Custom SSH Port: Standard non-default port reduces bot scan volume by >95%.

[ 2. KERNEL NETWORK SECURITY (sysctl) ]

TCP SYN Cookies Mitigates TCP SYN flood attacks via cryptographic sequence numbers.

TCP BBR Congestion Control Enables BBR + FQ queue discipline for lower latency and packet loss resilience.

Reverse Path Filtering (rp_filter) Drops spoofed IP packets that arrive on impossible interfaces.

Disable ICMP Redirects Prevents malicious gateway route injection and MITM routing changes.

Disable Source Routing Rejects packets that specify their own route path through the network.

Ignore Broadcast ICMP Mitigates Smurf amplification attacks on subnets.

TCP TIME-WAIT Assassination Guard Implements RFC 1337 protection against RST injection into TIME-WAIT sockets.

IPv4 Packet Forwarding Keep disabled on standalone servers; enable only for VPN / Router nodes.

[ 3. KERNEL MEMORY & PROCESS SECURITY ]

Full ASLR Randomization (Level 2) Randomizes stack, heap, and VDSO memory offsets against buffer overflow exploits.

Disable Unprivileged eBPF Blocks unprivileged users from injecting eBPF bytecode into the kernel.

Restrict dmesg Kernel Logs Prevents non-root users from reading kernel addresses and exploit offsets.

Kernel Pointer Restriction (kptr_restrict) Hides kernel pointers in /proc and sysfs from unprivileged processes.

Disable SUID Core Dumps Prevents credential extraction and memory dumps from crashing privileged binaries.

Protected Symlinks & Hardlinks Prevents symlink/hardlink race condition vulnerabilities in world-writable /tmp.

[ 4. OPENSSH DAEMON (sshd_config.d) ]

Disable Root Login Requires login via unprivileged user followed by sudo escalation.

Enforce Public Key Auth Only Completely disables password-based logins (eliminates brute-force risk).

Modern Cryptography Suite Only Restricts KEX to Curve25519, Ciphers to ChaCha20/AES-GCM, MACs to ETM.

MaxAuthTries 3 Disconnects sessions after 3 failed key/password attempts.

Disable X11 & Agent Forwarding Prevents SSH agent hijacking and malicious display hijacking.

ClientAlive Timeout (300s) Terminates idle and abandoned SSH connections after 5 minutes.

# Generating configuration...

/etc/sysctl.d/99-hardening.conf

[ DEPLOYMENT INSTRUCTIONS ]
1. Place file in directory:
sudo cp 99-hardening.conf /etc/sysctl.d/
2. Apply kernel settings immediately without reboot:
sudo sysctl --system

[ 1. WORKLOAD PRESET PROFILE ]

[ 2. KERNEL NETWORK SECURITY (sysctl) ]

[ 3. KERNEL MEMORY & PROCESS SECURITY ]

[ 4. OPENSSH DAEMON (sshd_config.d) ]

[ RELATED SECURITY BLUEPRINTS ]