implement some kernel network security features

[John Moser]

Bug created to link to specification:

https://launchpad.net/distros/ubuntu/+spec/improved-networking-security-kernel

This bug serves to house a patch I diffed out.

[John Moser (nigelenki)]

here is a patch to /etc/sysctl with loads of commentary.

[towsonu2003 (towsonu2003)]

sorry for my ignorance, but which package is the patch for? if kernel (looks like so), which version? dapper / edgy / st. before dapper? thanks (asking for triaging)

[John Moser (nigelenki)]

bluefox@icebox:~$ dpkg -S /etc/sysctl.conf
procps: /etc/sysctl.conf

procps, methinks. The target is some time after Edgy, and apparently the spec is now networking-security-sysctls.

'net.ipv4.conf.all.accept_redirects=0' has been disputed; the perceived problem seems to be that some bad infrastructure (two routers plugged into a switch hosting a network segment) will suffer excessive network traffic between the routers without redirects; and the threat of spoofing redirects (READ: NO AUTHENTICATION HERE) is outweighed by the threat of Ubuntu causing extra traffic because network administrators don't know how to enable this feature.

[Anthony S (aaaantoine)]

This was reported/submitted over a year ago. Has the patch been implemented yet? Is it still relevant?

[Anthony S (aaaantoine)]

Specification link is broken. No updates since October 2006. I'm closing this.

[John Moser (nigelenki)]

https://launchpad.net/ubuntu/+spec/networking-security-sysctls