Hardening Linux Kernel with sysctl & nftables Firewall rules

# ==============================================================================
# TechNHIT Enterprise Linux Kernel Hardening Configuration
# Path: /etc/sysctl.d/99-security-hardened.conf
# ==============================================================================

# --- TCP/IP Stack & Flood Defense ---
# Enable SYN Cookies to prevent SYN backlog queue exhaustion
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 4096

# Drop TCP TIME_WAIT assassination hazards (RFC 1337)
net.ipv4.tcp_rfc1337 = 1

# Disable ICMP echo broadcasts (Prevents Smurf Amplification attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# --- Anti-Spoofing & Reverse Path Filtering ---
# Strict Reverse Path Filtering (uRPF)
# Drops packets if source IP is not routable via the receiving interface
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Log impossible source IP packets (Martian addresses)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# --- Route & Redirect Hardening ---
# Prohibit source-routed packets (prevents IP spoofing via malicious gateways)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Do not accept ICMP redirects (prevents Man-In-The-Middle routing poisoning)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects (this host is an endpoint, not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Disable IP packet forwarding (ensure host does not route between interfaces)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# --- Kernel Memory & Pointer Obfuscation ---
# Restrict dmesg log access to users with CAP_SYSLOG
kernel.dmesg_restrict = 1

# Hide kernel memory pointer addresses in /proc and oops dumps
kernel.kptr_restrict = 2

# Prevent unprivileged users from creating BPF programs
kernel.unprivileged_bpf_disabled = 1

# Harden symlink and hardlink traversal against TOCTOU race conditions
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2

#!/usr/sbin/nft -f

# Flush existing ruleset
flush ruleset

# Unified IPv4 and IPv6 table
table inet filter {
    # SSH brute-force protection meter
    set ssh_flood {
        type ipv4_addr
        flags dynamic, timeout
        timeout 1m
    }

    chain input {
        type filter hook input priority 0; policy drop;

        # 1. Accept localhost traffic
        iif "lo" accept comment "Allow loopback interface"

        # 2. Stateful connection tracking
        ct state established,related accept comment "Accept established & related sessions"
        ct state invalid drop comment "Drop invalid TCP/IP packet states immediately"

        # 3. ICMP / ICMPv6 echo with rate limiting
        ip protocol icmp icmp type echo-request limit rate 5/second burst 10 packets accept comment "Rate-limited ICMP ping"
        ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert } accept comment "Allow essential IPv6 NDP & ICMPv6"

        # 4. SSH ingress with brute-force rate limiting (Max 4 attempts / minute)
        tcp dport 22 ct state new meter ssh_meter { ip saddr limit rate over 4/minute } drop comment "Mitigate SSH brute-force scans"
        tcp dport 22 ct state new accept comment "Allow legitimate SSH connections"

        # 5. Production HTTP & HTTPS ingress
        tcp dport { 80, 443 } ct state new accept comment "Allow public web ingress"

        # 6. Log and drop remaining unsolicited packets
        log prefix "[NFTABLES-DROP] " flags all limit rate 3/minute burst 5 packets
        counter drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        comment "Drop all routed packets - host is not a router"
    }

    chain output {
        type filter hook output priority 0; policy accept;
        comment "Permit outbound egress connections"
    }
}