From 403e7584ff6f0726d13151075d36d8cba8795b16 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sat, 10 Sep 2016 15:52:39 -0300
Subject: Adds nodo::subsystem::sysctl::tcp_challenge_ack_limit

---
 .../subsystem/sysctl/tcp_challenge_ack_limit.pp     | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 manifests/subsystem/sysctl/tcp_challenge_ack_limit.pp

(limited to 'manifests/subsystem/sysctl/tcp_challenge_ack_limit.pp')

diff --git a/manifests/subsystem/sysctl/tcp_challenge_ack_limit.pp b/manifests/subsystem/sysctl/tcp_challenge_ack_limit.pp
new file mode 100644
index 0000000..2f6c753
--- /dev/null
+++ b/manifests/subsystem/sysctl/tcp_challenge_ack_limit.pp
@@ -0,0 +1,21 @@
+# http://www.isssource.com/fixing-an-internet-security-threat/
+# https://access.redhat.com/security/vulnerabilities/challengeack
+# http://coolnerd.co/2016/08/researchers-announce-linux-kernel-network-snooping-bug-naked-security/
+# https://nakedsecurity.sophos.com/2016/08/12/researchers-announce-linux-kernel-network-snooping-bug/
+class nodo::subsystem::sysctl::tcp_challenge_ack_limit(
+  $ensure = hiera('nodo::sysctl::tcp_challenge_ack_limit', 'present'),
+) {
+  file { "/etc/sysctl.d/tcp_challenge_ack_limit.conf":
+    owner   => "root",
+    group   => "root",
+    mode    => 0644,
+    ensure  => $ensure,
+    content => "net.ipv4.tcp_challenge_ack_limit = 999999999\n",
+  }
+
+  exec { "sysctl-tcp_challenge_ack_limit":
+    command     => '/sbin/sysctl -p',
+    subscribe   => File["/etc/sysctl.d/tcp_challenge_ack_limit.conf"],
+    refreshonly => true,
+  }
+}
-- 
cgit v1.2.3