Sysctl Hardening

Tue, 29 Apr 2025 08:41:24 +0200

/etc/sysctl.conf - hardening

Official OpenBSD Documentation

Sysctl Parameter	Description
`ddb.panic=0`	Reboot on a panic, instead of dropping into the debugger.
`ddb.console=0`	Prevent entry into the kernel debugger.
`net.inet.ip.forwarding=0`	Prevent inet4 forwarding for standalone workstations ( unless needed ).
`machdep.allowaperature=0`	For systems that don’t run X.
`vm.malloc_conf=CFGU`	Individual arguments explained below.
C ( Cache disabled )	Reduces the chance that sensitive data ( like passwords, keys, etc ) remains in memory after being freed.
F ( Free junking )	Easier to detect user-after-free bugs ( access to freed memory ), and prevents old data from leaking if memory is later misused.
G ( Guard pages )	Helps catch buffer overflows immediately by causing a segmentation fault when memory writes go past their bounds.
U ( Use junking )	Helps catch bugs where programs wrongly assume newly allocated memory.

ddb.panic=0
ddb.console=0
vm.malloc_conf=CFGU
net.inet.ip.forwarding=0
machdep.allowaperature=0

ddb.panic=0
ddb.console=0
vm.malloc_conf=CFGU
net.inet.ip.forwarding=1
machdep.allowaperature=0

ddb.panic=1
ddb.console=1
vm.malloc_conf=CFGU
net.inet.ip.forwarding=0
machdep.allowaperature=1

Thanks to the author of the following page for teaching me about the malloc stuff:

Hardening on UNIX Esoterica