Sysctl.conf (Wheezy)

This is the commented sysctl.conf I use on my Debian Wheezy servers. Keep in mind that some of the values here are based on the size of the server. For example, my main webserver has 24 gigs reserved for huge pages, this document has four, I have since increased it to eight on the machine in question. Your mileage will vary.

/etc/sysctl.conf

# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additonal system variables
# See sysctl.conf (5) for information.
# 

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

# Disables the magic SysRq key
kernel.sysrq = 0

# So we know where they are when we need them
# You want this if you are doing a lot of crap. Hunting down core
# files can be extremely annoying.
kernel.core_pattern = /tmp/core-%e.%p

# Allow high shared memory values for hugepages
# shmmax is in bytes, shmall is in pages (typically 4k for x86 procs)
# This sets these values to 16 gigs, but you may need to increase this
# Note: This has been depreciated. Remaining here for posterity.
kernel.shmmax=34359738368
kernel.shmall=8388608

# Set our hugepage group, which is the new way to do it.
vm.hugetlb_shm_group = 72
# You will want to add the group for this accordingly, e.g.
# addgroup --gid 72 hugepager
# and then add appropriate users (mysql most likely) to said group.

# Maximum number of open files permitted. Commented out as you probably
# will not want it, but the default value has caused me trouble before,
# so highlighting it here.
# fs.file-max = 524288

# Each hugepage is 2 megabytes. This reserves 4 gigs + change.
# MySQL will want enough for the InnoDB data buffer, the MyISAM Key buffer, and
# a couple of other buffers. Other programs will also want their own.
vm.nr_hugepages = 2176

# Servers will in general want low amounts of swapping, but setting
# this to 5 or 10 is sometimes okay.
vm.swappiness = 0

# Net.Core tweaking.

# The socket version of netdev_max_backlog, apparently.
# Default is 128, and the connections go both ways!
# 128 is ridiculously low.
# somaxconn cannot be set above 65535 by default. 
net.core.somaxconn = 65535

# Maximum number of packets that can be stored in the buffer, if the
# system is getting more packets than the kernel can process.
# Default is 1000.
net.core.netdev_max_backlog = 65535

# Be default, we're probably not a router, but depending on your host you may
# need to enable ipv4 and/or ipv6 forwarding. 
net.ipv4.ip_forward = 0

#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
# Not in ipv6
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1

# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
# The above are set to zero because my servers are all single-homed.

# Redirects and source routes are for routers closer to
# the middle of the Internet than most websites and their
# immediate upstream routers.
# Do not send ICMP redirects 
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#
# Do not accept IP source route packets 
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
#
# Log Martian Packets
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0

# See http://lwn.net/Articles/277146/
# Helps protect against SYN floods.
# On a reasonably active webserver you'll see these get turned on often.
# Note: This may impact IPv6 TCP sessions too
# Now defaults to 1. Left in for posterity.
net.ipv4.tcp_syncookies=1

# Being a fairly active server with memory to spare, we can increase the backlog.
net.ipv4.tcp_max_syn_backlog = 8192

# The following is simply to free up connections a bit more aggressively.
# Sets the time to expire a connection after we send a FIN. Default is 60 seconds.
net.ipv4.tcp_fin_timeout = 30

# Allows reuse of sockets in Time Wait state.
net.ipv4.tcp_tw_reuse = 1

# Sets the time before keepalive probes start getting sent.
# Default is 7200 seconds.
net.ipv4.tcp_keepalive_time = 900

# Probes and probe interval. Default is to send up to nine probes, waiting up to
# 75 seconds for an ACK response to each probe. This is somewhat more aggressive.
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 15

# Ignore ICMP broadcasts
# These both defailt to 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Netfilter tweaking.

# Note that these might not be on a virgin install until you've run iptables. Leave them
# commented out until we have your firewall working.
# Turn on connection accounting
net.netfilter.nf_conntrack_acct = 1
# conntrack_max and conntrack_buckets may need to be improved in the event of an attack.
net.netfilter.nf_conntrack_max = 131072
net.nf_conntrack_max = 131072
# This doesn't work - have to set in modprobe - see the general security section.
# net.netfilter.nf_conntrack_buckets = 32768

Debian Wheezy

Initial: Designing a Server - IPMI Installation

---

Core: Network - OpenSSH - Packages - sysctl.conf - Iptables - Security - User Management

---

Stack: Unbound - MySQL - Nginx - PHP (5.4)

---

Mail

Mail Setup - Mail Tables - OpenDKIM - Mail and DNS - Spamassassin - ClamAV - Postfix - Dovecot - Reputation Management

---

Logs and Security: Logging - Logcheck - Backups - AppArmor