Linux SysCTL optimization

# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

#Prevent SYN attack
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# Disables packet forwarding
net.ipv4.ip_forward=0

# Disables IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Enable Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 1

# Disables the magic-sysrq key
kernel.sysrq = 0

# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15

# Decrease the time default value for tcp_keepalive_time connection
net.ipv4.tcp_keepalive_time = 1800

# Turn off the tcp_window_scaling
net.ipv4.tcp_window_scaling = 0

# Turn off the tcp_sack
net.ipv4.tcp_sack = 0

# Turn off the tcp_timestamps
net.ipv4.tcp_timestamps = 0

# Enable ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Set maximum amount of memory allocated to shm to 256MB
kernel.shmmax = 268435456

# Improve file system performance
vm.bdflush = 100 1200 128 512 15 5000 500 1884 2

# Improve virtual memory performance
vm.buffermem = 90 10 60

# Increase the maximum total TCP buffer-space allocatable
net.ipv4.tcp_mem = 3129344 3137536 3145728

# Increase the maximum TCP write-buffer-space allocatable
net.ipv4.tcp_wmem = 65536 1398080 2796160

# Increase the maximum TCP read-buffer space allocatable
net.ipv4.tcp_rmem = 65536 1398080 2796160

# Increase the maximum and default receive socket buffer size
net.core.rmem_max = 2097136
net.core.rmem_default = 1048560

# Increase the maximum and default send socket buffer size
net.core.wmem_max = 2097136
net.core.wmem_default = 1048560

# Increase the tcp-time-wait buckets pool size
net.ipv4.tcp_max_tw_buckets = 1440000

# Allowed local port range
net.ipv4.ip_local_port_range = 16384 65536

# Increase the maximum memory used to reassemble IP fragments
net.ipv4.ipfrag_high_thresh = 512000
net.ipv4.ipfrag_low_thresh = 446464

# Increase the maximum amount of option memory buffers
net.core.optmem_max = 163840

# Increase the maximum number of skb-heads to be cached
net.core.hot_list_length = 1024

### Filesystem tweaks
# Maximum number of files
fs.file-max = 110000


### System tweaks
# Disables the magic-sysrq key
#kernel.sysrq = 0

# vshelper location
kernel.vshelper = /usr/lib/util-vserver/vshelper

# Panic on Unknown_NMI
kernel.unknown_nmi_panic = 1

# Panic on OOPS
kernel.panic_on_oops = 1

# Reboot after panic
kernel.panic = 10


### IPv4 stack
# Disables packet forwarding
net.ipv4.ip_forward = 0

# Disables IP dynaddr
net.ipv4.ip_dynaddr = 0

# Disable ECN
net.ipv4.tcp_ecn = 0

# Enables source route verification
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0

# Disable ICMP echo-request altogether (use only if DOS'ed):
#net.ipv4.icmp_echo_ignore_all = 1

# Enable syn-cookies (prevent syn-flood attacks):
net.ipv4.tcp_syncookies = 1

# Reduce number of possible SYN Floods:
net.ipv4.tcp_max_syn_backlog = 1024

# Disable ICMP echo-request to broadcast addresses (Smurf amplifier):
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable defrag error protection:
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable time-wait assassination hazards in tcp (RFC 1337):
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_timestamps = 0

# Deactivate ICMP Redirect accept/send:
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Log spoofed, source routed and redirect packets:
net.ipv4.conf.all.log_martians = 1