← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-23741

CAT II (Medium)

TCP backlog queue sizes must be set appropriately.

Rule ID

SV-45720r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000366

Discussion

To provide some mitigation to TCP Denial of Service attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Check Content

# cat /proc/sys/net/ipv4/tcp_max_syn_backlog
If the result is not 1280 or greater, this is a finding.

Fix Text

Edit /etc/sysctl.conf and add a setting for "net.ipv4.tcp_max_syn_backlog=1280".

Procedure:
# echo "net.ipv4.tcp_max_syn_backlog=1280" >> /etc/sysctl.conf
# sysctl -p