# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.

# Reboot after kernel panic
kernel.panic=5

# Disable icmp redirects
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.default.secure_redirects=0

# Enable reverse path filtering on a received packet:
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1

#
# Alfresco specific optimisations
#
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 87380 16777216

net.ipv4.tcp_slow_start_after_idle = 0
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 87380 16777216
net.core.netdev_max_backlog = 30000
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_low_latency = 1
#
# END Alfresco specific optimisations
#

# Controls IPv6, disabled by default
net.ipv6.conf.default.disable_ipv6 = <%= node['sysctl']['disable_ipv6'] %>
net.ipv6.conf.all.disable_ipv6 = <%= node['sysctl']['disable_ipv6'] %>

# Controls IP packet forwarding
net.ipv4.ip_forward = 0

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1

# Disable netfilter on bridges.
# net.bridge.bridge-nf-call-ip6tables = 0
# net.bridge.bridge-nf-call-iptables = 0
# net.bridge.bridge-nf-call-arptables = 0

# Controls the maximum size of a message, in bytes
kernel.msgmnb = 65536

# Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536

# Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736

# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296

# PDP added for security 7th Oct 2011

# Disable ICMP replies to broadcast addresses. This prevents a Smurf attack.
# http://www.cert.org/advisories/CA-1998-01.html
net.ipv4.icmp_echo_ignore_broadcasts=1

# Do not honour ICMP redirect requests. An ICMP redirect is a request by a client to
# update a servers routing table. Clearly in an untrusted environment, this is
# unacceptable.
net.ipv4.conf.all.accept_redirects=0

# Ignore messages associated with disabling ICMP redirects above.
net.ipv4.icmp_ignore_bogus_error_responses=1

# Disable TCP timestamps. The reply to a timestamp request can be used to
# determine system uptime. An information leakage.
# http://www.securiteam.com/securitynews/5NP0C153PI.html
net.ipv4.tcp_timestamps=0

# Increased logging of suspicious packets. A martian packet is defined as one
# seen at a particular interface that would not normally be expected there.
net.ipv4.conf.all.log_martians=1
