Lab: Apply sysctl hardening and validate the result

This lab applies a sysctl hardening baseline and verifies each setting took effect. By the end you will have a documented baseline that survives reboot.

Objective

By the end of this lab, you can:

Apply a sysctl hardening baseline.
Verify each setting took effect.
Confirm critical applications still work.
Document the baseline.

Architecture

Any Linux host. The baseline applies to most server roles (web, database, application). For routers, you would change ip_forward = 0 to ip_forward = 1.

Tasks

Task 1: Capture the current state

sysctl -a > /tmp/sysctl-before.txt
wc -l /tmp/sysctl-before.txt

Task 2: Apply the hardening baseline

Create /etc/sysctl.d/99-hardening.conf:

# Kernel hardening
kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.unprivileged_bpf_disabled = 1
kernel.unprivileged_userns_clone = 0
net.core.bpf_jit_harden = 2

# Network hardening
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

Apply:

sudo sysctl -p /etc/sysctl.d/99-hardening.conf

Task 3: Verify each setting

sysctl kernel.randomize_va_space
sysctl kernel.kptr_restrict
sysctl kernel.dmesg_restrict
sysctl net.ipv4.tcp_syncookies
sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.all.accept_redirects

Each should return the expected value.

Task 4: Smoke-test applications

If the host runs nginx:

systemctl status nginx
curl http://localhost/

# Test from another host
curl http://<host>/

If the host runs SSH:

systemctl status sshd
ssh user@localhost

If the host runs a database:

systemctl status postgresql
psql -U postgres -c 'SELECT 1'

If anything fails, investigate whether the failure is sysctl-related.

Task 5: Test the boot

sudo reboot

After reboot:

sysctl kernel.randomize_va_space
sysctl net.ipv4.tcp_syncookies

The settings should still be applied (loaded from /etc/sysctl.d/99-hardening.conf).

Task 6: Document the baseline

SYSCTL HARDENING BASELINE
=========================
Host: <host>
Date: 2026-08-09

Files: /etc/sysctl.d/99-hardening.conf

Settings applied:
- kernel.randomize_va_space = 2 (full ASLR)
- kernel.kptr_restrict = 2 (hide kernel pointers)
- kernel.dmesg_restrict = 1 (dmesg restricted)
- kernel.unprivileged_bpf_disabled = 1 (BPF restricted)
- kernel.unprivileged_userns_clone = 0 (user namespaces restricted)
- net.core.bpf_jit_harden = 2 (BPF JIT hardened)
- net.ipv4.ip_forward = 0 (no forwarding)
- net.ipv4.tcp_syncookies = 1 (SYN flood protection)
- net.ipv4.conf.*.accept_redirects = 0 (no ICMP redirects)
- net.ipv4.conf.*.accept_source_route = 0 (no source routing)
- net.ipv4.conf.*.log_martians = 1 (log martians)
- net.ipv4.icmp_echo_ignore_broadcasts = 1 (no broadcast ping)
- net.ipv4.conf.*.rp_filter = 1 (reverse-path filter)
- net.ipv6.conf.*.accept_redirects = 0
- net.ipv6.conf.*.accept_source_route = 0

Verification:
- All settings returned expected values after apply
- All settings survived reboot
- nginx still serves content
- SSH still works
- No application breakage detected

Save for future comparison.

Validation

The hardening file is in /etc/sysctl.d/.
All settings are applied.
Settings survive reboot.
Applications still work.

Cleanup

Revert by removing the file:

sudo rm /etc/sysctl.d/99-hardening.conf
sudo sysctl -p

Or restore the previous sysctl values (capture them first in step 1 if needed).

What you learned

A sysctl hardening is a series of layered settings.
Each setting has a specific purpose; document them.
Test before reboot; reboot before production.
Persist via /etc/sysctl.d/ for boot-time application.

Objectives

Prerequisites