How to Harden Linux Server Security by Tuning Kernel Parameters with Sysctl on Ubuntu

ByAkensai

Learning how to harden Linux server security by tuning kernel parameters with sysctl on Ubuntu is one of the most effective things you can do to protect your server. Most Ubuntu installations ship with default kernel settings. Those defaults are designed for broad compatibility, not security. By adjusting sysctl parameters, you can close common attack vectors, reduce your exposure to network-based exploits, and make your server significantly harder to compromise. This tutorial walks you through the exact steps to do that. You’ll learn which parameters matter most, what they actually do, and how to apply them permanently. Whether you’re running a VPS, a dedicated server, or a local lab machine, these changes will make a real difference.

Prerequisites for Hardening Linux Server Security with Sysctl

Before you start, make sure you have the following in place.

Required access and software:

  • A server running Ubuntu 20.04 or Ubuntu 22.04
  • Root or sudo access to the server
  • A basic understanding of the Linux command line
  • A text editor such as nano or vim

Assumed knowledge: You should be comfortable running commands in a terminal. You don’t need to be a Linux expert. If you can SSH into a server and edit a file, you’re ready.

Estimated time: This tutorial takes about 20 to 30 minutes to complete.

Important note: Always test these changes in a staging environment first. Some kernel parameters can affect network connectivity. If you’re working on a remote server, have a backup access method ready, such as a console or out-of-band management panel.

Back up your current sysctl configuration before making any changes. Run this command:

sudo cp /etc/sysctl.conf /etc/sysctl.conf.bak

This gives you a restore point if anything goes wrong.

How to Harden Linux Server Security by Tuning Kernel Parameters with Sysctl

See also: How to Create and Configure Custom Systemd Services on Linux

Follow these steps carefully. Each step explains what the setting does and why it matters.

Step 1: Open the sysctl configuration file.

Open the main configuration file with your text editor:

sudo nano /etc/sysctl.conf

This file controls persistent kernel parameters. Changes here survive reboots.

Step 2: Disable IP forwarding.

Unless your server acts as a router, IP forwarding should be off. Add these lines:

net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

Enabling IP forwarding on a non-router server can allow attackers to route traffic through your machine.

Step 3: Enable SYN flood protection.

SYN flood attacks overwhelm your server with half-open connections. Enable SYN cookies to defend against this:

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

SYN cookies allow your server to handle legitimate connections even under a flood attack.

Step 4: Ignore ICMP broadcast requests and bogus errors.

These settings reduce your exposure to Smurf attacks and noisy log entries:

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

Step 5: Disable source routing and ICMP redirects.

Source routing lets a sender specify the route a packet takes. Attackers use this to bypass firewalls. Disable it:

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

Step 6: Enable reverse path filtering.

Reverse path filtering blocks spoofed packets. If a packet arrives on an interface but the source address doesn’t match the routing table, the kernel drops it:

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

Step 7: Log suspicious packets and disable send redirects.

Log martian packets (packets with impossible source addresses) and stop your server from sending ICMP redirects:

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

Step 8: Harden shared memory and kernel pointers.

These settings protect against local privilege escalation attacks:

kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
fs.suid_dumpable = 0

Setting randomize_va_space to 2 enables full Address Space Layout Randomization (ASLR). This makes it much harder for attackers to predict memory addresses. You can read more about ASLR and kernel hardening in the official Linux kernel sysctl documentation.

Step 9: Apply all changes immediately.

Save the file and exit nano with CTRL+X, then Y, then Enter. Apply your changes without rebooting:

sudo sysctl -p

This loads all settings from /etc/sysctl.conf right away. You’ll see each parameter printed to the terminal as it’s applied. If you see any errors, check the parameter name for typos.

Step 10: Verify the settings are active.

Confirm a specific setting is applied with this command:

sudo sysctl net.ipv4.tcp_syncookies

The output should show net.ipv4.tcp_syncookies = 1. Run similar checks for any parameter you want to verify.

Troubleshooting Common Sysctl Issues on Ubuntu

Problem: A parameter returns an error when you run sysctl -p.

This usually means the parameter name is wrong or not supported by your kernel version. Double-check the spelling. You can search for available parameters with:

sudo sysctl -a | grep parameter_name

Replace parameter_name with the string you’re looking for.

Problem: Changes don’t persist after a reboot.

Make sure your settings are in /etc/sysctl.conf or a file inside /etc/sysctl.d/. Settings applied with sysctl -w at the command line are temporary. They don’t survive a reboot.

Problem: You’ve lost SSH connectivity after applying changes.

If you accidentally broke network connectivity, use your server’s console access to revert. Restore your backup:

sudo cp /etc/sysctl.conf.bak /etc/sysctl.conf
sudo sysctl -p

Tip: You can also drop individual hardening rules into separate files inside /etc/sysctl.d/. For example, create /etc/sysctl.d/99-hardening.conf. Ubuntu reads all .conf files in that directory at boot. This keeps your changes organized and separate from the default configuration. The Ubuntu Server documentation covers this approach in more detail.

Warning: Don’t blindly copy sysctl configs from the internet. Some settings are workload-specific. A parameter that makes sense for a web server might cause problems on a database server. Test every change.

Conclusion: Keep Your Linux Server Kernel Hardened

You now know how to harden Linux server security by tuning kernel parameters with sysctl on Ubuntu. You’ve disabled IP forwarding, enabled SYN flood protection, blocked source routing, and enabled ASLR. These changes address real attack vectors that affect unprotected servers every day. Sysctl hardening is just one layer of a complete security strategy. Pair it with a properly configured firewall like ufw, regular package updates, and SSH key-based authentication for the best results. Review your sysctl settings periodically. Kernel versions change, new parameters become available, and your server’s role may evolve over time. Keep your configuration documented so you always know what’s running and why.

Similar Posts