Fuel master sysctl.conf security hardening
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Fuel for OpenStack |
Won't Fix
|
Medium
|
Stanislaw Bogatkin | ||
8.0.x |
Won't Fix
|
Medium
|
Stanislaw Bogatkin | ||
Mitaka |
Won't Fix
|
Medium
|
Stanislaw Bogatkin | ||
Newton |
Won't Fix
|
Medium
|
Stanislaw Bogatkin |
Bug Description
Detailed bug description:
Observe Linux network stack sysctl values of Fuel master node.
Expected results:
generic-
For Linux systems ensure the following sysctl values are set:
* net.ipv4.
* net.ipv4.
* net.ipv6.
* net.ipv4.
* net.ipv6.
sysctl -w net.ipv4.
sysctl -w net.ipv4.
sysctl -w net.ipv6.
sysctl -w net.ipv4.
sysctl -w net.ipv6.
More Linux information can be found at https:/
linux-icmp-redirect
Disable ICMP redirect support
Issue the following commands as root:
sysctl -w net.ipv4.
sysctl -w net.ipv4.
sysctl -w net.ipv4.
sysctl -w net.ipv4.
These settings can be added to /etc/sysctl.conf to make them permanent.
generic-
Disable TCP timestamp responses on Linux
Set the value of net.ipv4.
sysctl -w net.ipv4.
Additionally, put the following value in the default sysctl configuration file, generally sysctl.conf:
net.ipv4.
Changed in fuel: | |
importance: | Undecided → Medium |
Changed in fuel: | |
milestone: | 10.1 → 11.0 |
assignee: | nobody → Fuel Sustaining (fuel-sustaining-team) |
status: | New → Confirmed |
tags: | added: area-library |
Changed in fuel: | |
assignee: | Oleksiy Molchanov (omolchanov) → Fuel Sustaining (fuel-sustaining-team) |
status: | In Progress → Confirmed |
Changed in fuel: | |
assignee: | Fuel Sustaining (fuel-sustaining-team) → Stanislaw Bogatkin (sbogatkin) |
Fix proposed to branch: master /review. openstack. org/409746
Review: https:/