Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 49)

Chapter 2. The /proc File System 49

• message_burst — Tenths of seconds required to write a new warning message. This is used to

prevent Denial of Service (DoS) attacks. The default setting is 50.

• message_cost — Also used to prevent DoS attacks by placing a cost on every warning message.

The higher the value of this ﬁle (default of 5), the more likely the warning message will be ignored.

The idea is that an attacker could bombard your system with requests that generate errors and ﬁll

up your logs or require all of your system’s resources to handle error logging. The settings in mes-

sage_burst and message_cost are designed to be modiﬁed based on your system’s acceptable

risk versus the need for comprehensive logging.

• netdev_max_backlog — Sets the maximum number of packets allowed to queue when a partic-

ular interface receives packets faster than the kernel can process them. The default value for this

ﬁle is 300.

• optmem_max — Conﬁgures the maximum ancillary buffer size allowed per socket.

• rmem_default — Sets the receive socket buffer’s default size in bytes.

• rmem_max — Sets the receive socket buffer’s maximum size in bytes.

• wmem_default — Sets the send socket buffer’s default size in bytes.

• wmem_max — Sets the send socket buffer’s maximum size in bytes.

The /ipv4 directory contains additional networking settings. Many of these settings, used in con-

junction with one another, are very useful in preventing attacks on the system or using the system to

act as a router.

Caution

An erroneous change to these ﬁles may affect your remote connectivity to the system.

Here are some of the most important ﬁles in the /proc/net/ipv4/ directory:

• icmp_destunreach_rate, icmp_echoreply_rate, icmp_paramprob_rate and

icmp_timeexeed_rate — Set the maximum ICMP send packet rate, in hundredths of a second,

to hosts under certain conditions. A setting of 0 removes any delay and is not a good idea.

• icmp_echo_ignore_all and icmp_echo_ignore_broadcasts — Allows the kernel to ignore

ICMP ECHO packets from every host or only those originating from broadcast and multicast ad-

dresses, respectively. A value of 0 allows the kernel to respond, while a value of 1 ignores the

packets.

• ip_default_ttl — Sets the default Time To Live (TTL), which limits the number of hops a packet

may make before reaching its destination. Increasing this value can diminish system performance.

• ip_forward — Permits interfaces on the system to forward packets to one other. By default, this

ﬁle is set to 0. Setting this ﬁle to 1 will enable network packet forwarding.

• ip_local_port_range — Speciﬁes the range of ports to be used by TCP or UDP when a local

port is needed. The ﬁrst number is the lowest port to be used, and the second number speciﬁes the

highest port. Any systems that expect to require more ports than the default 1024 to 4999 should

use the 32768 to 61000 range in this ﬁle.

• tcp_syn_retries — Provides a limit on the number of times your system will re-transmit a SYN

packet when attempting to make a connection.

• tcp_retries1 — Sets the number of permitted re-transmissions attempting to answer an incom-

ing connection. Default of 3.

• tcp_retries2 — Sets the number of permitted re-transmissions of TCP packets. Default of 15.

1 2 ... 44 45 46 47 48 49 50 51 52 53 54 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 49

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE