diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2019-06-18 22:27:34 +0200 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2019-06-18 22:27:34 +0200 |
| commit | 93861a9714f689e597efb5d11030cbc996148b90 (patch) | |
| tree | 44d235c1b32866bc9009536c5b1d884a9c638090 /roles/base | |
| parent | enable acmetool live certs (diff) | |
disable TCP Sack
Diffstat (limited to 'roles/base')
| -rw-r--r-- | roles/base/vars/main.yml | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/roles/base/vars/main.yml b/roles/base/vars/main.yml index 557a4a7c..d228b088 100644 --- a/roles/base/vars/main.yml +++ b/roles/base/vars/main.yml @@ -43,3 +43,8 @@ sysctl_config: # Prevent against the common 'syn flood attack' net.ipv4.tcp_syncookies: 1 + + # Disable Selective Acknowledgement (SACK) + # Workaround CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 + # See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md + net.ipv4.tcp_sack: 0 |