Fuel master sysctl.conf security hardening

[Adam Heczko]

Detailed bug description:
Observe Linux network stack sysctl values of Fuel master node.

Expected results:
generic-ip-source-routing-enabled
For Linux systems ensure the following sysctl values are set:
 * net.ipv4.conf.all.accept_source_route=0
 * net.ipv4.conf.all.forwarding=0
 * net.ipv6.conf.all.forwarding=0
 * net.ipv4.conf.all.mc_forwarding=0
 * net.ipv6.conf.all.mc_forwarding=0

sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv4.conf.all.forwarding=0
sysctl -w net.ipv6.conf.all.forwarding=0
sysctl -w net.ipv4.conf.all.mc_forwarding=0
sysctl -w net.ipv6.conf.all.mc_forwarding=0

More Linux information can be found at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-Server_Security-Disable-Source-Routing.html

linux-icmp-redirect
Disable ICMP redirect support
Issue the following commands as root:
 sysctl -w net.ipv4.conf.all.accept_redirects=0
 sysctl -w net.ipv4.conf.default.accept_redirects=0
 sysctl -w net.ipv4.conf.all.secure_redirects=0
 sysctl -w net.ipv4.conf.default.secure_redirects=0
These settings can be added to /etc/sysctl.conf to make them permanent.

generic-tcp-timestamp
Disable TCP timestamp responses on Linux
Set the value of net.ipv4.tcp_timestamps to 0 by running the following command:
sysctl -w net.ipv4.tcp_timestamps=0
Additionally, put the following value in the default sysctl configuration file, generally sysctl.conf:
net.ipv4.tcp_timestamps=0

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/409746

[OpenStack Infra (hudson-openstack)]

Change abandoned by Oleksiy Molchanov (<email address hidden>) on branch: master
Review: https://review.openstack.org/409746

[Oleksiy Molchanov (omolchanov)]

It looks like a feature and needs a lot of efforts and test coverage to implement this.

Also Fuel relies on part of the suggested parameters.

Closing as Invalid.

[Oleksiy Molchanov (omolchanov)]

Sorry, won't fix.