/proc/sys 网络安全选项的调整 · 让系统对 ping 没有反应 · 让系统对广播没有反应 · 取消 IP source routing · 开启 TCP SYN Cookie 保护 · 取消 ICMP 接受 Redirect · 开启错误讯息保护 · 开启 IP 欺骗保护 · 记录Spoofed Packets, Source Routed Packets, Redirect Packets Redhat 6.1 的做法: [root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all [root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts [root@deep /]# for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do > echo 0 > $f > done [root@deep /]# echo 1 > /proc/sys/net/ipv4/tcp_syncookies [root@deep /]# for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do > echo 0 > $f > done [root@deep /]# echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses [root@deep /]# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do > echo 0 > $f > done [root@deep /]# for f in /proc/sys/net/ipv4/conf/*/log_martians; do > echo 0 > $f > done Redhat 6.2 的做法: 编辑 "/etc/sysctl.conf" 档案，并加入下面几行， # Enable ignoring ping request net.ipv4.icmp_echo_ignore_all = 1 # Enable ignoring broadcasts request net.ipv4.icmp_echo_ignore_broadcasts = 1 # Disables IP source routing net.ipv4.conf.all.accept_source_route = 0 # Enable TCP SYN Cookie Protection net.ipv4.tcp_syncookies = 1 # Disable ICMP Redirect Acceptance net.ipv4.conf.all.accept_redirects = 0 # Enable bad error message Protection net.ipv4.icmp_ignore_bogus_error_responses = 1 # Enable IP spoofing protection, turn on Source Address Verification net.ipv4.conf.all.rp_filter = 1 # Log Spoofed Packets, Source Routed Packets, Redirect Packets net.ipv4.conf.all.log_martians = 1 最后重新激活 network [root@deep /]# /etc/rc.d/init.d/network restart
（出处：http://www.sheup.com）