> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/system-hardening/what-predefined-checks-does-enginsight-provide-for-automatic-system-hardening.md).

# What predefined checks does Enginsight provide for automatic system hardening?

[Automatic system hardening](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/compliance/automatic-system-hardening-checklists) helps you meet technical requirements and legal compliance obligations.

It includes security-relevant technical checks for your hosts, which are performed automatically. If required, the corresponding system hardening is automatically rolled out to the assigned hosts.

For this purpose, Enginsight provides [managed checklist catalogs](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/compliance/automatic-system-hardening-checklists#importing-a-checklist-catalog) with predefined checks, also referred to as controls, for various operating systems. In the following, we show you which checks are available for [Windows hosts](#checks-for-automatic-system-hardening-on-windows-systems) and [Linux hosts](#checks-for-automatic-system-hardening-on-linux-systems) respectively.

***

## Checks for Automatic System Hardening on Windows Hosts

<table><thead><tr><th width="269.7578125">Name</th><th>Description</th></tr></thead><tbody><tr><td>Block Microsoft Accounts for Local Sign-in</td><td><strong>Block Microsoft Accounts for Local Sign-in</strong> sets the registry value <code>NoConnectedUser</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</code> to <code>3</code> when activated. The value 3 blocks both adding and logging on with Microsoft accounts, so the system relies on locally managed accounts and its exposure to compromised online accounts is reduced.</td></tr><tr><td>Force Audit Subcategory Settings to Override Category Settings</td><td><strong>Force Audit Subcategory Settings to Override Category Settings</strong> sets the registry value <code>SCENoApplyLegacyAuditPolicy</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa</code> to <code>1</code> when activated. The value 1 makes granular audit subcategory settings take precedence over the legacy broad category settings, which allows more precise audit configuration and improves the detection of relevant security events.</td></tr><tr><td>Require CTRL+ALT+DEL Before Login</td><td><strong>Require CTRL+ALT+DEL Before Login</strong> sets the registry value <code>DisableCAD</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</code> to <code>0</code> when activated. The value 0 enforces the secure attention sequence (CTRL+ALT+DEL) before sign-in, a key combination only the operating system can intercept, making it harder for fake logon screens to capture user credentials.</td></tr><tr><td>Do Not Display Last Signed-in Username</td><td><strong>Do Not Display Last Signed-in Username</strong> sets the registry value <code>DontDisplayLastUserName</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</code> to <code>1</code> when activated. The value 1 hides the last logged-on account on the logon screen, which limits the disclosure of valid user names to onlookers and reduces information useful for targeted attacks.</td></tr><tr><td>Always Digitally Sign Communications (Client)</td><td><strong>Always Digitally Sign Communications (Client)</strong> sets the registry value <code>RequireSecuritySignature</code> under <code>HKLM\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters</code> to <code>1</code> when activated. The value 1 forces the SMB client to require digital signing of all communications, which protects the integrity of transmitted data and reduces the risk of tampering and man-in-the-middle manipulation.</td></tr><tr><td>Digitally Sign Communications If Server Agrees</td><td><strong>Digitally Sign Communications If Server Agrees</strong> sets the registry value <code>EnableSecuritySignature</code> under <code>HKLM\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters</code> to <code>1</code> when activated. The value 1 makes the SMB client negotiate signing whenever the server supports it, which strengthens the integrity of the connection and reduces the risk of tampering with transmitted data.</td></tr><tr><td>Always Digitally Sign Communications (Server)</td><td><strong>Always Digitally Sign Communications (Server)</strong> sets the registry value <code>RequireSecuritySignature</code> under <code>HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters</code> to <code>1</code> when activated. The value 1 forces the SMB server to require digital signing of all communications, which protects the authenticity and integrity of transmitted data and reduces the risk of tampering and man-in-the-middle manipulation.</td></tr><tr><td>Digitally Sign Communications If Client Agrees</td><td><strong>Digitally Sign Communications If Client Agrees</strong> sets the registry value <code>EnableSecuritySignature</code> under <code>HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters</code> to <code>1</code> when activated. The value 1 makes the SMB server negotiate signing whenever the connecting client supports it, which strengthens the integrity of the connection and reduces the risk of tampering with transmitted data.</td></tr><tr><td>Do Not Allow Storage of Passwords and Credentials for Network Authentication</td><td><strong>Do Not Allow Storage of Passwords and Credentials for Network Authentication</strong> sets the registry value <code>DisableDomainCreds</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa</code> to <code>1</code> when activated. The value 1 stops Windows from caching passwords and credentials for network authentication in Credential Manager, which reduces the exposure of reusable secrets if the system is compromised.</td></tr><tr><td>NULL Session Fallback prevented for LocalSystem</td><td><strong>NULL Session Fallback prevented for LocalSystem</strong> sets the registry value <code>allownullsessionfallback</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0</code> to <code>0</code> when activated. The value 0 forbids NTLM from falling back to unauthenticated NULL sessions, which limits anonymous access paths and reduces the risk of unauthorized access.</td></tr><tr><td>Set Minimum Session Security Requirements for NTLM SSP Based Clients</td><td><strong>Set Minimum Session Security Requirements for NTLM SSP Based Clients</strong> sets the registry value <code>NTLMMinClientSec</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0</code> to <code>537395200</code> when activated. This value (0x20080000) forces NTLM SSP clients to require NTLMv2 session security and 128-bit encryption, which hardens outbound NTLM sessions against tampering and eavesdropping.</td></tr><tr><td>Set Minimum Session Security for NTLM SSP Based Servers</td><td><strong>Set Minimum Session Security for NTLM SSP Based Servers</strong> sets the registry value <code>NTLMMinServerSec</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0</code> to <code>537395200</code> when activated. This value (0x20080000) forces NTLM SSP servers to require NTLMv2 session security and 128-bit encryption, hardening inbound NTLM sessions against interception and modification.</td></tr><tr><td>Enforce Admin Approval Mode for the Built-in Administrator Account</td><td><strong>Enforce Admin Approval Mode for the Built-in Administrator Account</strong> sets the registry value <code>FilterAdministratorToken</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</code> to <code>1</code> when activated. Value <code>1</code> places the built-in Administrator under User Account Control so elevated actions require explicit approval, which limits the impact of a compromised or misused administrator account.</td></tr><tr><td>Behavior of the Elevation Prompt for Administrators in Admin Approval Mode</td><td><strong>Behavior of the Elevation Prompt for Administrators in Admin Approval Mode</strong> sets the registry value <code>ConsentPromptBehaviorAdmin</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</code> to <code>2</code> when activated. Value <code>2</code> means "prompt for consent on the secure desktop", so every elevation must be confirmed on an isolated desktop, which reduces the risk of silent or spoofed privilege escalation.</td></tr><tr><td>Prevent Enabling Lock Screen Camera</td><td><strong>Prevent Enabling Lock Screen Camera</strong> sets the registry value <code>NoLockScreenCamera</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization</code> to <code>1</code> when activated. Value <code>1</code> disables camera access from the lock screen, which reduces the attack surface for unauthorized viewing or recording while the device is locked.</td></tr><tr><td>Turn Off Multicast Name Resolution (LLMNR)</td><td><strong>Turn Off Multicast Name Resolution (LLMNR)</strong> sets the registry value <code>EnableMulticast</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient</code> to <code>0</code> when activated. Value <code>0</code> disables Link-Local Multicast Name Resolution, which reduces the attack surface for name-resolution spoofing and credential-relay attacks on the local network.</td></tr><tr><td>Turn Off Microsoft Peer-to-Peer Networking Services</td><td><strong>Turn Off Microsoft Peer-to-Peer Networking Services</strong> sets the registry value <code>Disabled</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Peernet</code> to <code>1</code> when activated. Value <code>1</code> turns off the peer-to-peer networking services, which removes unnecessary network functionality and reduces the exposed attack surface.</td></tr><tr><td>Enable Script Block Logging</td><td><strong>Enable Script Block Logging</strong> sets the registry value <code>EnableScriptBlockLogging</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\PowerShell\ScriptBlockLogging</code> to <code>1</code> when activated. Value <code>1</code> records executed PowerShell script blocks to the event log, which improves detection of malicious scripts and supports forensic analysis.</td></tr><tr><td>Enable Transcription for Powershell Sessions</td><td><strong>Enable Transcription for Powershell Sessions</strong> sets the registry value <code>EnableTranscripting</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\PowerShell\Transcription</code> to <code>1</code> when activated. Value <code>1</code> records the input and output of PowerShell sessions to transcript files, which improves auditing and helps detect unauthorized or malicious PowerShell usage.</td></tr><tr><td>Apply Strict Driver Initialization Policy</td><td><strong>Apply Strict Driver Initialization Policy</strong> sets the registry value <code>DriverLoadPolicy</code> under <code>HKLM\SYSTEM\CurrentControlSet\Policies\EarlyLaunch</code> to <code>3</code> when activated. Value <code>3</code> tells Early Launch Anti-Malware to load only boot-start drivers classified as good, unknown, or bad-but-critical, which hardens the boot path against known-malicious drivers while keeping the system bootable.</td></tr><tr><td>Turn Off Windows Messenger Customer Experience Improvement Program</td><td><strong>Turn Off Windows Messenger Customer Experience Improvement Program</strong> sets the registry value <code>CEIP</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Messenger\Client</code> to <code>2</code> when activated, where <code>2</code> disables participation. This limits usage and diagnostic data sent from Windows Messenger to Microsoft, reducing the amount of information leaving the system.</td></tr><tr><td>Turn Off Downloading of Print Drivers Over HTTP</td><td><strong>Turn Off Downloading of Print Drivers Over HTTP</strong> sets the registry value <code>DisableWebPnPDownload</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers</code> to <code>1</code> when activated, where <code>1</code> blocks HTTP-based driver downloads. This prevents the system from fetching printer drivers over HTTP and thereby reduces the risk of retrieving manipulated or compromised drivers from untrusted sources.</td></tr><tr><td>Turn Off Windows Error Reporting (Method 1)</td><td><strong>Turn Off Windows Error Reporting (Method 1)</strong> sets the registry value <code>DoReport</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</code> to <code>0</code> when activated, where <code>0</code> disables error reporting. This stops the system from transmitting crash and diagnostic data to Microsoft and limits the exposure of potentially sensitive information.</td></tr><tr><td>Turn Off Windows Error Reporting (Method 2)</td><td><strong>Turn Off Windows Error Reporting (Method 2)</strong> sets the registry value <code>Disabled</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting</code> to <code>1</code> when activated, where <code>1</code> turns error reporting off. This prevents crash and diagnostic data from being sent to Microsoft and reduces the exposure of potentially sensitive information.</td></tr><tr><td>Turn Off Internet Download for Web Publishing and Online Ordering Wizards</td><td><strong>Turn Off Internet Download for Web Publishing and Online Ordering Wizards</strong> sets the registry value <code>NoWebServices</code> under <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</code> to <code>1</code> when activated, where <code>1</code> blocks the download of provider lists for these wizards. This stops the system from fetching components from the internet and reduces the attack surface for retrieving unwanted or malicious software.</td></tr><tr><td>Turn Off Windows Customer Experience Improvement Program</td><td><strong>Turn Off Windows Customer Experience Improvement Program</strong> sets the registry value <code>CEIPEnable</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows</code> to <code>0</code> when activated, where <code>0</code> disables participation. This limits the telemetry and usage data sent from Windows to Microsoft and reduces the amount of information leaving the system.</td></tr><tr><td>Turn Off Convenience PIN Sign-in</td><td><strong>Turn Off Convenience PIN Sign-in</strong> sets the registry value <code>AllowDomainPINLogon</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\System</code> to <code>0</code> when activated, where <code>0</code> disables PIN sign-in for domain users. This removes the convenience PIN as an alternative to the domain password and reduces the attack surface tied to a locally cached credential.</td></tr><tr><td>Turn Off App Notifications on the Lock Screen</td><td><strong>Turn Off App Notifications on the Lock Screen</strong> sets the registry value <code>DisableLockScreenAppNotifications</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\System</code> to <code>1</code> when activated, where <code>1</code> suppresses app notifications on the lock screen. This limits the exposure of potentially sensitive notification content while the device is locked.</td></tr><tr><td>Do Not Display Network Selection UI On Login Screen</td><td><strong>Do Not Display Network Selection UI On Login Screen</strong> sets the registry value <code>DontDisplayNetworkSelectionUI</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\System</code> to <code>1</code> when activated, where <code>1</code> hides the network selection interface at the logon screen. This prevents unauthenticated users from changing network connectivity from the lock screen and reduces the exposure of the device before sign-in.</td></tr><tr><td>Require a Password When a Computer Wakes While Plugged In</td><td><strong>Require a Password When a Computer Wakes While Plugged In</strong> sets the registry value <code>ACSettingIndex</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51</code> to <code>1</code> when activated, where <code>1</code> enforces a password prompt on wake in AC (mains) power mode. This requires authentication when the device resumes from sleep while plugged in and limits unauthorized access to an unattended system.</td></tr><tr><td>Require a Password When a Computer Wakes While On Battery</td><td><strong>Require a Password When a Computer Wakes While On Battery</strong> sets the registry value <code>DCSettingIndex</code> under HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 to <code>1</code> when activated (DC denotes battery/direct-current operation, 1 enables the prompt). Requiring a password on wake limits the exposure of an unattended device and reduces the risk of unauthorized local access.</td></tr><tr><td>Configure User Control Over Windows Installer</td><td><strong>Configure User Control Over Windows Installer</strong> sets the registry value <code>EnableUserControl</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer to <code>0</code> when activated (0 denies users control over installation-related properties). Preventing users from influencing installer behavior limits the risk of unauthorized or elevated installations and reduces the attack surface for software-based misuse.</td></tr><tr><td>Limit Local Account Use of Blank Passwords to Console Logon Only</td><td><strong>Limit Local Account Use of Blank Passwords to Console Logon Only</strong> sets the registry value <code>LimitBlankPasswordUse</code> under HKLM\SYSTEM\CurrentControlSet\Control\Lsa to <code>1</code> when activated (1 restricts blank-password accounts to console logon). Blocking network, remote-desktop, and service logons for accounts with empty passwords reduces the remote attack surface.</td></tr><tr><td>Prevent Users from Installing Printer Drivers</td><td><strong>Prevent Users from Installing Printer Drivers</strong> sets the registry value <code>AddPrinterDrivers</code> under HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters to <code>1</code> when activated (1 restricts adding printer drivers to administrators). Limiting driver installation to privileged accounts reduces the risk of malicious or untrusted kernel-level drivers being introduced by standard users.</td></tr><tr><td>Allow System to Be Shut Down Without Having to Log On</td><td>Despite its name, <strong>Allow System to Be Shut Down Without Having to Log On</strong> sets the registry value <code>ShutdownWithoutLogon</code> under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System to <code>0</code> when activated (0 removes the shutdown button from the logon screen). Requiring authentication before shutdown reduces the risk that an unauthenticated person at the console can disrupt or power off the system.</td></tr><tr><td>Disable Font Providers</td><td><strong>Disable Font Providers</strong> sets the registry value <code>EnableFontProviders</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\System to <code>0</code> when activated (0 blocks downloading fonts and font-catalog data from online providers). Preventing this network activity reduces outbound exposure and the attack surface tied to fetching content from external font services.</td></tr><tr><td>Disable Insecure guest logons</td><td><strong>Disable Insecure guest logons</strong> sets the registry value <code>AllowInsecureGuestAuth</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\System to <code>0</code> when activated (0 stops the SMB client from using unauthenticated guest access). Blocking insecure guest logons hardens SMB connections against man-in-the-middle attacks and unauthorized access to shared resources.</td></tr><tr><td>Turn on I/O Mapper for Link Layer Topology Discovery (AllowLLTDIOOndomain)</td><td>Despite its name, <strong>Turn on I/O Mapper for Link Layer Topology Discovery (AllowLLTDIOOndomain)</strong> sets the registry value <code>AllowLLTDIOOnDomain</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD to <code>0</code> when activated (0 disables the Link Layer Topology Discovery Mapper I/O driver on domain networks). Turning off this network-mapping protocol reduces the device's discoverability and limits the attack surface on managed networks.</td></tr><tr><td>Turn on I/O Mapper for Link Layer Topology Discovery (AllowLLTDIOOnPublicNet)</td><td>Despite its name, <strong>Turn on I/O Mapper for Link Layer Topology Discovery (AllowLLTDIOOnPublicNet)</strong> sets the registry value <code>AllowLLTDIOOnPublicNet</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD to <code>0</code> when activated (0 disables the Link Layer Topology Discovery Mapper I/O driver on public networks). Turning off this network-mapping protocol on untrusted networks reduces the device's discoverability and limits its exposure.</td></tr><tr><td>Turn on I/O Mapper for Link Layer Topology Discovery (EnableLLTDIO)</td><td>Despite its name, <strong>Turn on I/O Mapper for Link Layer Topology Discovery (EnableLLTDIO)</strong> sets the registry value <code>EnableLLTDIO</code> under HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD to <code>0</code> when activated (0 disables the Link Layer Topology Discovery Mapper I/O driver). Turning off this network-mapping protocol reduces the device's discoverability on the network and limits the associated attack surface.</td></tr><tr><td>Turn on I/O Mapper for Link Layer Topology Discovery (ProhibitLLTDIOOnPrivateNet)</td><td><strong>Turn on I/O Mapper for Link Layer Topology Discovery (ProhibitLLTDIOOnPrivateNet)</strong> sets the registry value <code>ProhibitLLTDIOOnPrivateNet</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD</code> to <code>0</code> when activated. The value 0 reflects the disabled state of the LLTD Mapper I/O (LLTDIO) driver, which discovers and maps devices on the network; keeping it off limits network topology enumeration and reduces the information exposed to other hosts.</td></tr><tr><td>Disable Responder (RSPNDR) driver (AllowRspndrOnDomain)</td><td><strong>Disable Responder (RSPNDR) driver (AllowRspndrOnDomain)</strong> sets the registry value <code>AllowRspndrOnDomain</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD</code> to <code>0</code> when activated. The value 0 disables the Link Layer Topology Discovery Responder (RSPNDR) driver on domain networks, so the host stops answering topology-discovery requests, reducing its visibility and attack surface on the network.</td></tr><tr><td>Disable Responder (RSPNDR) driver (AllowRspndrOnPublicNet)</td><td><strong>Disable Responder (RSPNDR) driver (AllowRspndrOnPublicNet)</strong> sets the registry value <code>AllowRspndrOnPublicNet</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD</code> to <code>0</code> when activated. The value 0 disables the Link Layer Topology Discovery Responder (RSPNDR) driver on public networks, so the host no longer answers topology-discovery requests in untrusted environments, reducing its visibility and attack surface.</td></tr><tr><td>Disable Responder (RSPNDR) driver. (EnableRspndr)</td><td><strong>Disable Responder (RSPNDR) driver (EnableRspndr)</strong> sets the registry value <code>EnableRspndr</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD</code> to <code>0</code> when activated. The value 0 turns off the Link Layer Topology Discovery Responder (RSPNDR) driver entirely, so the host does not respond to topology-discovery requests, reducing its network visibility and attack surface.</td></tr><tr><td>Disable Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)</td><td><strong>Disable Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)</strong> sets the registry value <code>ProhibitRspndrOnPrivateNet</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD</code> to <code>0</code> when activated. The value 0 is the state written when the Responder (RSPNDR) driver is turned off via group policy on private networks, limiting the host's responses to topology-discovery requests and reducing its network visibility.</td></tr><tr><td>Prohibit installation and configuration of Network Bridge</td><td><strong>Prohibit installation and configuration of Network Bridge</strong> sets the registry value <code>NC_AllowNetBridge_NLA</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\Network Connections</code> to <code>0</code> when activated, which corresponds to the Group Policy of the same name in the Enabled state (the ADMX uses enabledValue=0). Preventing users from bridging separate network segments through their host limits unintended lateral network paths and reduces the attack surface.</td></tr><tr><td>Prohibit use of Network Bridge</td><td><strong>Prohibit use of Network Bridge</strong> sets the registry value <code>NC_ShowSharedAccessUI</code> under <code>HKLM\Software\Policies\Microsoft\Windows\Network Connections</code> to <code>1</code> when activated. Controlling whether users can bridge or share network connections through their host helps limit unintended lateral network paths and reduce attack surface.</td></tr><tr><td>Require domain users to elevate when setting a networks location</td><td><strong>Require domain users to elevate when setting a networks location</strong> sets the registry value <code>NC_StdDomainUserSetLocation</code> under <code>HKLM\Software\Policies\Microsoft\Windows\Network Connections</code> to <code>1</code> when activated. The value 1 forces standard domain users to obtain administrative elevation before changing a network's location (for example from Public to Private), preventing them from silently loosening the firewall profile and reducing attack surface.</td></tr><tr><td>Activate hardened UNC Paths</td><td><strong>Activate hardened UNC Paths</strong> sets the registry value <code>\\*\NETLOGON</code> under <code>HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths</code> to <code>RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1</code> when activated. These flags require mutual authentication, integrity checking, and privacy (encryption) for connections to the NETLOGON share, hardening access to domain logon scripts against tampering and man-in-the-middle attacks.</td></tr><tr><td>Activate hardened UNC Paths (SYSVOL)</td><td><strong>Activate hardened UNC Paths (SYSVOL)</strong> sets the registry value <code>\\*\SYSVOL</code> under <code>HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths</code> to <code>RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1</code> when activated. These flags require mutual authentication, integrity checking, and privacy (encryption) for connections to the SYSVOL share, hardening access to domain group policy files against tampering and man-in-the-middle attacks.</td></tr><tr><td>Deactivate WCN Registrar</td><td><strong>Deactivate WCN Registrar</strong> sets the registry value <code>EnableRegistrars</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars</code> to <code>0</code> when activated. The value <code>0</code> turns off the Windows Connect Now registrar, which reduces the attack surface for automatic device discovery and configuration.</td></tr><tr><td>Deactivate WCN Registrar (DisableUPnPRegistrar)</td><td><strong>Deactivate WCN Registrar (DisableUPnPRegistrar)</strong> sets the registry value <code>DisableUPnPRegistrar</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars</code> to <code>0</code> when activated. The value <code>0</code> disables the UPnP (Ethernet) transport of the Windows Connect Now registrar, which limits exposure to unwanted device discovery over the network.</td></tr><tr><td>Deactivate WCN Registrar (DisableInBand802DOT11Registrar)</td><td><strong>Deactivate WCN Registrar (DisableInBand802DOT11Registrar)</strong> sets the registry value <code>DisableInBand802DOT11Registrar</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars</code> to <code>0</code> when activated. The value <code>0</code> disables the in-band 802.11 Wi-Fi transport of the Windows Connect Now registrar, which reduces the attack surface for wireless device configuration.</td></tr><tr><td>Deactivate WCN Registrar (DisableFlashConfigRegistrar)</td><td><strong>Deactivate WCN Registrar (DisableFlashConfigRegistrar)</strong> sets the registry value <code>DisableFlashConfigRegistrar</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars</code> to <code>0</code> when activated. The value <code>0</code> disables the USB flash drive transport of the Windows Connect Now registrar, which limits exposure to configuration via removable media.</td></tr><tr><td>Deactivate WCN Registrar (DisableWPDRegistrar)</td><td><strong>Deactivate WCN Registrar (DisableWPDRegistrar)</strong> sets the registry value <code>DisableWPDRegistrar</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars</code> to <code>0</code> when activated. The value <code>0</code> disables the Windows Portable Device (WPD) transport of the Windows Connect Now registrar, which reduces the attack surface for device configuration over the WPD API.</td></tr><tr><td>Prohibit access of the Windows Connect Now wizards</td><td><strong>Prohibit access of the Windows Connect Now wizards</strong> sets the registry value <code>DisableWcnUi</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\UI</code> to <code>1</code> when activated. The value <code>1</code> disables the Windows Connect Now wizard interface, which lowers the attack surface by preventing standard users from configuring devices through it.</td></tr><tr><td>Prevent Wi-Fi when on Ethernet</td><td><strong>Prevent Wi-Fi when on Ethernet</strong> sets the registry value <code>fMinimizeConnections</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy</code> to <code>3</code> when activated. The value <code>3</code> disables Wi-Fi while a wired Ethernet connection is active, which reduces the attack surface by preventing bridged connections between internal and external networks.</td></tr><tr><td>Prohibit additional connection to non-domain networks</td><td><strong>Prohibit additional connection to non-domain networks</strong> sets the registry value <code>fBlockNonDomain</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy</code> to <code>1</code> when activated. The value <code>1</code> blocks a system from connecting to a domain and a non-domain network at the same time, which reduces the attack surface by preventing simultaneous exposure to untrusted networks.</td></tr><tr><td>Block client connections to Print Spooler service</td><td><strong>Block client connections to Print Spooler service</strong> sets the registry value <code>RegisterSpoolerRemoteRpcEndPoint</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers</code> to <code>2</code> when activated. The value <code>2</code> disables the remote RPC endpoint so the Print Spooler no longer accepts inbound client connections, which reduces the attack surface for remote print spooler exploits.</td></tr><tr><td>Activate Redirection Guard</td><td><strong>Activate Redirection Guard</strong> sets the registry value <code>RedirectionguardPolicy</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers</code> to <code>1</code> when activated. The value <code>1</code> enables Redirection Guard for the print spooler, which hardens the spooler against exploitation via manipulated file and path redirections.</td></tr><tr><td>Configure RPC connection settings (RpcUseNamedPipeProtocol)</td><td><strong>Configure RPC connection settings (RpcUseNamedPipeProtocol)</strong> sets the registry value <code>RpcUseNamedPipeProtocol</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC</code> to <code>0</code> when activated (0 = do not use the named-pipe protocol for outgoing print RPC). Restricting the spooler to RPC over TCP removes the older named-pipe transport and reduces the attack surface of remote print connections.</td></tr><tr><td>Configure RPC connection settings (RpcAuthentication)</td><td><strong>Configure RPC connection settings (RpcAuthentication)</strong> sets the registry value <code>RpcAuthentication</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC</code> to <code>0</code> when activated (0 = Default, meaning authentication for print RPC connections is negotiated automatically). Enforcing a defined authentication behavior for print RPC hardens remote spooler communication and limits unauthenticated access.</td></tr><tr><td>Configure RPC connection settings (RpcProtocols)</td><td><strong>Configure RPC connection settings (RpcProtocols)</strong> sets the registry value <code>RpcProtocols</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC</code> to <code>5</code> when activated (5 selects the recommended protocol set for outgoing print RPC, RPC over TCP). Pinning the spooler to the intended transport hardens remote print connections and reduces the exposed protocol surface.</td></tr><tr><td>Configure RPC connection settings (ForceKerberosForRpc)</td><td><strong>Configure RPC connection settings (ForceKerberosForRpc)</strong> sets the registry value <code>ForceKerberosForRpc</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC</code> to <code>0</code> when activated (0 = Negotiate, Kerberos is not strictly forced for print RPC). Defining the authentication package behavior for print RPC hardens remote spooler communication in line with the policy baseline.</td></tr><tr><td>Configure RPC over TCP port</td><td><strong>Configure RPC over TCP port</strong> sets the registry value <code>RpcTcpPort</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC</code> to <code>0</code> when activated (0 = the spooler uses a dynamically assigned port instead of a fixed one). Avoiding a static, predictable RPC port reduces the exposure of the print spooler to targeted remote connections.</td></tr><tr><td>Configure RPC packet level privacy (print)</td><td><strong>Configure RPC packet level privacy (print)</strong> sets the registry value <code>RpcAuthnLevelPrivacyEnabled</code> under <code>HKLM\SYSTEM\CurrentControlSet\Control\Print</code> to <code>1</code> when activated (1 = packet-level privacy enabled). Enforcing packet privacy protects incoming print RPC traffic against reading and tampering on the network.</td></tr><tr><td>Configure Windows protected print</td><td><strong>Configure Windows protected print</strong> sets the registry value <code>WindowsProtectedPrintGroupPolicyState</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\WPP</code> to <code>1</code> when activated (1 = Windows protected print enabled). The protected print mode restricts printing to a more constrained, modern stack and reduces the attack surface exposed by legacy print components.</td></tr><tr><td>Block non-Admins from installing printer driver</td><td><strong>Block non-Admins from installing printer driver</strong> sets the registry value <code>RestrictDriverInstallationToAdministrators</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint</code> to <code>1</code> when activated (1 = only administrators may install print drivers). Restricting driver installation to administrators limits an established privilege-escalation path via malicious or unsigned print drivers.</td></tr><tr><td>Limit Queue-specific files to Color profiles</td><td><strong>Limit Queue-specific files to Color profiles</strong> sets the registry value <code>CopyFilesPolicy</code> under <code>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers</code> to <code>1</code> when activated (1 = only color-profile files are copied during printer installation). Restricting queue-specific files to color profiles prevents arbitrary files from being delivered through printer installation and reduces the attack surface of the print spooler.</td></tr><tr><td>Elevation prompt for new connections to printers</td><td><strong>Elevation prompt for new connections to printers</strong> sets the registry value <code>NoWarningNoElevationOnInstall</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint</code> to <code>0</code> when activated (0 = warnings and elevation prompts are not suppressed when a new printer connection is created). Keeping the elevation prompt active preserves administrative approval for driver installation and limits silent Point-and-Print abuse.</td></tr><tr><td>Elevation prompt for printer driver updates</td><td><strong>Elevation prompt for printer driver updates</strong> sets the registry value <code>UpdatePromptSettings</code> under <code>HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint</code> to <code>0</code> when activated. The value 0 keeps the elevation prompt enabled, so installing or updating a Point-and-Print printer driver requires administrative confirmation; this hardens the driver-installation path and reduces the attack surface for privilege escalation through malicious print drivers.</td></tr></tbody></table>

***

## Checks for Automatic System Hardening on Linux Hosts

<table><thead><tr><th width="269.69921875">Name</th><th>Description</th></tr></thead><tbody><tr><td>Set SSH Client Idle Interval</td><td><strong>Set SSH Client Idle Interval</strong> sets <code>ClientAliveInterval</code> in <code>/etc/ssh/sshd_config</code> to <code>15</code> when activated, so the server sends a keepalive probe every 15 seconds on an otherwise silent connection. This lets the daemon detect and close unattended or broken sessions quickly, reducing the window in which an abandoned session could be misused.</td></tr><tr><td>Set SSH Idle Timeout Threshold</td><td><strong>Set SSH Idle Timeout Threshold</strong> sets <code>ClientAliveCountMax</code> in <code>/etc/ssh/sshd_config</code> to <code>3</code> when activated, allowing at most three unanswered keepalive probes before the server terminates the connection. Combined with the alive interval this bounds how long an unresponsive session stays open, limiting exposure of idle sessions.</td></tr><tr><td>Disable SSH Host-Based Authentication</td><td><strong>Disable SSH Host-Based Authentication</strong> sets <code>HostbasedAuthentication</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated, so the server no longer accepts logins based on trust between hosts. This removes a trust relationship that a compromised host could otherwise use to reach the system without individual credentials.</td></tr><tr><td>Reduce SSH Login Grace Time</td><td><strong>Reduce SSH Login Grace Time</strong> sets <code>LoginGraceTime</code> in <code>/etc/ssh/sshd_config</code> to <code>60</code> when activated, giving each connection 60 seconds to complete authentication before it is dropped. Shortening this window frees up connection slots faster and reduces the room available for brute-force and connection-flooding attempts.</td></tr><tr><td>Ensure sshd MaxSessions is configured</td><td><strong>Ensure sshd MaxSessions is configured</strong> sets <code>MaxSessions</code> in <code>/etc/ssh/sshd_config</code> to <code>10</code> when activated, capping the number of open sessions permitted per network connection at ten. This bounds resource use per connection and limits how many multiplexed channels a single client can open at once.</td></tr><tr><td>Ensure sshd MaxStartups is configured</td><td><strong>Ensure sshd MaxStartups is configured</strong> sets <code>MaxStartups</code> in <code>/etc/ssh/sshd_config</code> to <code>10:30:60</code> when activated, meaning that from 10 unauthenticated connections onward new ones are dropped at a rising probability, reaching 100 percent at 60. This throttles floods of half-open connections and reduces the impact of denial-of-service attempts against the daemon.</td></tr><tr><td>Ensure sshd PermitUserEnvironment is disabled</td><td><strong>Ensure sshd PermitUserEnvironment is disabled</strong> sets <code>PermitUserEnvironment</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated, so environment options from user files such as ~/.ssh/environment are ignored at login. This prevents users from injecting environment variables that could alter the session and reduces the risk of privilege or path manipulation.</td></tr><tr><td>Ensure sshd Ciphers are configured</td><td><strong>Ensure sshd Ciphers are configured</strong> writes <code>Ciphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc</code> into <code>/etc/ssh/sshd_config</code> when activated; the leading minus removes the weak CBC-mode ciphers 3des-cbc, aes128-cbc, aes192-cbc and aes256-cbc from the enabled set. Dropping these legacy ciphers keeps SSH connections on stronger algorithms and reduces exposure to known CBC-mode weaknesses.</td></tr><tr><td>Disable SSH X11 Forwarding</td><td><strong>Disable SSH X11 Forwarding</strong> sets <code>X11Forwarding</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated, so the server no longer tunnels the X11 graphical protocol over SSH sessions. Removing this channel closes a path that could be abused to reach graphical applications or the local display and reduces the SSH attack surface.</td></tr><tr><td>Enable DisableForwarding</td><td><strong>Enable DisableForwarding</strong> sets <code>DisableForwarding</code> in <code>/etc/ssh/sshd_config</code> to <code>yes</code> when activated, which turns off all SSH forwarding features including TCP, X11 and agent forwarding at once. Blocking these tunnels prevents SSH from being used to pivot to other services and reduces the attack surface of the daemon.</td></tr><tr><td>Ensure sshd GSSAPIAuthentication is disabled</td><td><strong>Ensure sshd GSSAPIAuthentication is disabled</strong> sets <code>GSSAPIAuthentication</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated. Disabling GSSAPI-based authentication removes a rarely used authentication path and reduces the SSH attack surface.</td></tr><tr><td>Enable Ignoring of Rhosts Files in SSH</td><td><strong>Enable Ignoring of Rhosts Files in SSH</strong> sets <code>IgnoreRhosts</code> in <code>/etc/ssh/sshd_config</code> to <code>yes</code> when activated. Ignoring legacy .rhosts and .shosts trust files forces individual authentication and reduces the risk of unauthorized access via host-based trust.</td></tr><tr><td>Ensure sshd KexAlgorithms is configured</td><td><strong>Ensure sshd KexAlgorithms is configured</strong> sets <code>KexAlgorithms</code> in <code>/etc/ssh/sshd_config</code> to a value with a leading <code>-</code>, which removes the weak SHA-1 key-exchange methods <code>diffie-hellman-group1-sha1</code>, <code>diffie-hellman-group14-sha1</code> and <code>diffie-hellman-group-exchange-sha1</code> from the enabled set. Excluding these outdated algorithms hardens the key exchange and limits exposure to downgrade attacks on the negotiated session keys.</td></tr><tr><td>Set an Appropriate SSH Logging Level</td><td><strong>Set an Appropriate SSH Logging Level</strong> sets <code>LogLevel</code> in <code>/etc/ssh/sshd_config</code> to <code>VERBOSE</code> when activated. More detailed logging (including key fingerprints used for login) improves traceability of SSH access and supports detection of suspicious activity.</td></tr><tr><td>Use Only Robust SSH MAC Algorithms</td><td><strong>Use Only Robust SSH MAC Algorithms</strong> sets <code>MACs</code> in <code>/etc/ssh/sshd_config</code> to a value with a leading <code>-</code>, which removes the following weak message authentication codes from the enabled set: <code>hmac-md5</code>, <code>hmac-md5-96</code>, <code>hmac-ripemd160</code>, <code>hmac-sha1-96</code>, <code>umac-64@openssh.com</code>, <code>hmac-md5-etm@openssh.com</code>, <code>hmac-md5-96-etm@openssh.com</code>, <code>hmac-ripemd160-etm@openssh.com</code>, <code>hmac-sha1-96-etm@openssh.com</code>, <code>umac-64-etm@openssh.com</code> and <code>umac-128-etm@openssh.com</code>. Excluding these weak integrity algorithms hardens SSH sessions against forgery and downgrade attacks.</td></tr><tr><td>Limit SSH Authentication Attempts</td><td><strong>Limit SSH Authentication Attempts</strong> sets <code>MaxAuthTries</code> in <code>/etc/ssh/sshd_config</code> to <code>4</code> when activated. Capping the number of authentication attempts per connection slows down brute-force and password-guessing attacks against SSH.</td></tr><tr><td>Disallow SSH Logins with Empty Passwords</td><td><strong>Disallow SSH Logins with Empty Passwords</strong> sets <code>PermitEmptyPasswords</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated. Rejecting logins for accounts with empty passwords closes a trivial access path and reduces the risk of unauthorized system access.</td></tr><tr><td>Ensure sshd PermitRootLogin is disabled</td><td><strong>Ensure sshd PermitRootLogin is disabled</strong> sets <code>PermitRootLogin</code> in <code>/etc/ssh/sshd_config</code> to <code>no</code> when activated. Blocking direct root logins over SSH enforces individual accountability and reduces the risk of privileged access being compromised directly.</td></tr><tr><td>Ensure sshd UsePAM is enabled</td><td><strong>Ensure sshd UsePAM is enabled</strong> sets <code>UsePam</code> in <code>/etc/ssh/sshd_config</code> to <code>yes</code> when activated. Enabling PAM (Pluggable Authentication Modules) lets SSH use the system's central access and session controls, which improves enforcement of account policies.</td></tr><tr><td>Disable Anonymous FTP Access</td><td><strong>Disable Anonymous FTP Access</strong> sets <code>anonymous_enable=NO</code> in <code>/etc/vsftpd.conf</code> when activated. Turning off anonymous FTP logins ties all file transfers to authenticated users and reduces the exposure of the FTP service to unidentified access.</td></tr><tr><td>Restrict FTP Users to Their Home Directories</td><td><strong>Restrict FTP Users to Their Home Directories</strong> sets <code>chroot_local_user</code> in <code>/etc/vsftpd.conf</code> to <code>YES</code> when activated. This confines local FTP users to their own home directory, reducing exposure of system-wide files to authenticated FTP sessions.</td></tr><tr><td>Limit Anonymous FTP Transfer Rate</td><td><strong>Limit Anonymous FTP Transfer Rate</strong> sets <code>anon_max_rate</code> in <code>/etc/vsftpd.conf</code> to <code>30000</code> (bytes per second) when activated. Capping the throughput of anonymous sessions limits resource abuse and reduces the risk of bandwidth-based denial-of-service conditions.</td></tr><tr><td>Limit Local FTP User Transfer Rate</td><td><strong>Limit Local FTP User Transfer Rate</strong> sets <code>local_max_rate</code> in <code>/etc/vsftpd.conf</code> to <code>30000</code> (bytes per second) when activated. Capping the throughput of local FTP users limits resource abuse and reduces the risk of a single account overloading the server.</td></tr><tr><td>Set FTP Idle Session Timeout</td><td><strong>Set FTP Idle Session Timeout</strong> sets <code>idle_session_timeout</code> in <code>/etc/vsftpd.conf</code> to <code>300</code> (seconds) when activated. Automatically closing idle sessions after five minutes frees server resources and shortens the window in which an unattended connection could be misused.</td></tr><tr><td>Limit FTP Sessions per IP Address</td><td><strong>Limit FTP Sessions per IP Address</strong> sets <code>max_per_ip</code> in <code>/etc/vsftpd.conf</code> to <code>50</code> when activated. Capping the number of concurrent connections from one address limits resource exhaustion and reduces the impact of connection-flooding attempts.</td></tr><tr><td>Enable Local FTP User Access</td><td><strong>Enable Local FTP User Access</strong> sets <code>local_enable=YES</code> in <code>/etc/vsftpd.conf</code> when activated, allowing authenticated local system accounts to use FTP. Taken alone it enables a service rather than restricting one, so it is meant to be applied together with the other vsftpd hardening checks: Disable Anonymous FTP Access (<code>anonymous_enable=NO</code>), Restrict FTP Users to Their Home Directories (<code>chroot_local_user=YES</code>), Limit Local FTP User Transfer Rate (<code>local_max_rate</code>), Set FTP Idle Session Timeout (<code>idle_session_timeout</code>) and Limit FTP Sessions per IP Address (<code>max_per_ip</code>). In that combination it replaces anonymous access with accountable, chroot-confined and rate-limited local logins, reducing the exposure of the FTP service.</td></tr><tr><td>Enable ASLR for Memory Randomization</td><td><strong>Enable ASLR for Memory Randomization</strong> sets <code>kernel.randomize_va_space</code> in <code>/etc/sysctl.conf</code> to <code>2</code> (full randomization) when activated and reloads sysctl. Randomizing process memory layout makes memory addresses harder to predict, raising the difficulty of exploiting memory-corruption vulnerabilities.</td></tr><tr><td>Disable IPv4 Packet Redirects (All Interfaces)</td><td><strong>Disable IPv4 Packet Redirects (All Interfaces)</strong> sets <code>net.ipv4.conf.all.send_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated and reloads sysctl. Preventing the host from sending ICMP redirects on all interfaces limits its ability to influence routing tables and reduces the risk of traffic being redirected maliciously.</td></tr><tr><td>Disable IPv4 Packet Redirects (Default)</td><td><strong>Disable IPv4 Packet Redirects (Default)</strong> sets <code>net.ipv4.conf.default.send_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated and reloads sysctl. Applying this default to newly added interfaces stops the host from sending ICMP redirects and reduces the risk of attackers altering network traffic paths.</td></tr><tr><td>Disable IPv4 Packet Forwarding</td><td><strong>Disable IPv4 Packet Forwarding</strong> sets <code>net.ipv4.ip_forward</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated and reloads sysctl. Preventing the system from routing packets between interfaces reduces the attack surface on hosts that are not intended to act as routers.</td></tr><tr><td>Disable IPv6 Packet Forwarding</td><td><strong>Disable IPv6 Packet Forwarding</strong> sets <code>net.ipv6.conf.all.forwarding</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated, applied via sysctl. Preventing the host from routing IPv6 packets reduces attack surface on systems that are not intended to act as routers.</td></tr><tr><td>Refuse IPv4 Source-Routed Packets (All Interfaces)</td><td><strong>Refuse IPv4 Source-Routed Packets (All Interfaces)</strong> sets <code>net.ipv4.conf.all.accept_source_route</code> in <code>/etc/sysctl.conf</code> to <code>0</code> on all interfaces when activated, applied via sysctl. Rejecting source-routed packets limits an attacker's ability to dictate the path traffic takes and bypass routing controls.</td></tr><tr><td>Refuse IPv4 Source-Routed Packets (Default)</td><td><strong>Refuse IPv4 Source-Routed Packets (Default)</strong> sets <code>net.ipv4.conf.default.accept_source_route</code> in <code>/etc/sysctl.conf</code> to <code>0</code> for the default interface policy when activated, applied via sysctl. Refusing source-routed packets by default limits an attacker's ability to redirect traffic on newly added interfaces and bypass routing controls.</td></tr><tr><td>Refuse IPv6 Source-Routed Packets (All Interfaces)</td><td><strong>Refuse IPv6 Source-Routed Packets (All Interfaces)</strong> sets <code>net.ipv6.conf.all.accept_source_route</code> in <code>/etc/sysctl.conf</code> to <code>0</code> on all interfaces when activated, applied via sysctl. Rejecting IPv6 source-routed packets limits an attacker's ability to control the path traffic takes and circumvent routing controls.</td></tr><tr><td>Refuse IPv6 Source-Routed Packets (Default)</td><td><strong>Refuse IPv6 Source-Routed Packets (Default)</strong> sets <code>net.ipv6.conf.default.accept_source_route</code> in <code>/etc/sysctl.conf</code> to <code>0</code> for the default interface policy when activated, applied via sysctl. Refusing IPv6 source-routed packets by default limits traffic redirection on newly added interfaces and makes routing manipulation harder.</td></tr><tr><td>Reject IPv4 ICMP Redirects (All Interfaces)</td><td><strong>Reject IPv4 ICMP Redirects (All Interfaces)</strong> sets <code>net.ipv4.conf.all.accept_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> on all interfaces when activated, applied via sysctl. Ignoring ICMP redirect messages limits an attacker's ability to alter the routing table and reroute traffic.</td></tr><tr><td>Reject IPv4 ICMP Redirects (Default)</td><td><strong>Reject IPv4 ICMP Redirects (Default)</strong> sets <code>net.ipv4.conf.default.accept_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> for the default interface policy when activated, applied via sysctl. Ignoring ICMP redirects by default limits routing-table manipulation on newly added interfaces.</td></tr><tr><td>Reject IPv6 ICMP Redirects (All Interfaces)</td><td><strong>Reject IPv6 ICMP Redirects (All Interfaces)</strong> sets <code>net.ipv6.conf.all.accept_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> on all interfaces when activated, applied via sysctl. Ignoring IPv6 ICMP redirect messages limits an attacker's ability to alter the routing table and reroute traffic.</td></tr><tr><td>Reject IPv6 ICMP Redirects (Default)</td><td><strong>Reject IPv6 ICMP Redirects (Default)</strong> sets <code>net.ipv6.conf.default.accept_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> for the default interface policy when activated, applied via sysctl. Ignoring IPv6 ICMP redirects by default limits routing-table manipulation on newly added interfaces.</td></tr><tr><td>Disallow Secure IPv4 ICMP Redirects (Default)</td><td><strong>Disallow Secure IPv4 ICMP Redirects (Default)</strong> sets <code>net.ipv4.conf.default.secure_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> for the default interface policy when activated, applied via sysctl. This stops accepting ICMP redirects even from configured gateways, reducing routing manipulation if a trusted gateway is compromised.</td></tr><tr><td>Disallow Secure IPv4 ICMP Redirects (All Interfaces)</td><td><strong>Disallow Secure IPv4 ICMP Redirects (All Interfaces)</strong> sets <code>net.ipv4.conf.all.secure_redirects</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated. Ignoring ICMP redirects even from listed gateways reduces the attack surface for route manipulation, since a compromised gateway can no longer reroute the system's traffic.</td></tr><tr><td>Enable Logging of Suspicious IPv4 Packets (All Interfaces)</td><td><strong>Enable Logging of Suspicious IPv4 Packets (All Interfaces)</strong> sets <code>net.ipv4.conf.all.log_martians</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. Logging packets with impossible (martian) source addresses on all interfaces improves detection of spoofing and misrouting and supports later investigation.</td></tr><tr><td>Enable Logging of Suspicious IPv4 Packets (Default)</td><td><strong>Enable Logging of Suspicious IPv4 Packets (Default)</strong> sets <code>net.ipv4.conf.default.log_martians</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. Applying martian-packet logging as the default for newly added interfaces improves detection of spoofed or misrouted traffic and supports later investigation.</td></tr><tr><td>Ignore Broadcast ICMP Echo Requests</td><td><strong>Ignore Broadcast ICMP Echo Requests</strong> sets <code>net.ipv4.icmp_echo_ignore_broadcasts</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. Not answering ICMP echo requests sent to broadcast addresses limits the system's use as an amplifier in reflection attacks such as Smurf.</td></tr><tr><td>Ignore Bogus ICMP Error Responses</td><td><strong>Ignore Bogus ICMP Error Responses</strong> sets <code>net.ipv4.icmp_ignore_bogus_error_responses</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. Discarding invalid ICMP error messages avoids log flooding from misconfigured or malicious routers and keeps log data more usable for detection.</td></tr><tr><td>Enable IPv4 Reverse Path Filtering (All Interfaces)</td><td><strong>Enable IPv4 Reverse Path Filtering (All Interfaces)</strong> sets <code>net.ipv4.conf.all.rp_filter</code> in <code>/etc/sysctl.conf</code> to <code>1</code> (strict mode) when activated. Validating that packets arrive on the interface their source route points to helps detect and drop spoofed source addresses.</td></tr><tr><td>Enable IPv4 Reverse Path Filtering (Default)</td><td><strong>Enable IPv4 Reverse Path Filtering (Default)</strong> sets <code>net.ipv4.conf.default.rp_filter</code> in <code>/etc/sysctl.conf</code> to <code>1</code> (strict mode) when activated. Applying reverse path filtering as the default for newly added interfaces helps detect and drop packets with spoofed source addresses.</td></tr><tr><td>Enable TCP SYN Cookies</td><td><strong>Enable TCP SYN Cookies</strong> sets <code>net.ipv4.tcp_syncookies</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. Validating connection requests with SYN cookies when the backlog fills helps the system stay reachable during SYN flood attacks.</td></tr><tr><td>Reject IPv6 Router Advertisements (All Interfaces)</td><td><strong>Reject IPv6 Router Advertisements (All Interfaces)</strong> sets <code>net.ipv6.conf.all.accept_ra</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated. Not accepting IPv6 router advertisements on any interface reduces the attack surface for injecting rogue routes or default gateways.</td></tr><tr><td>Reject IPv6 Router Advertisements (Default)</td><td><strong>Reject IPv6 Router Advertisements (Default)</strong> sets <code>net.ipv6.conf.default.accept_ra</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated. Rejecting IPv6 router advertisements as the default for newly added interfaces reduces the risk of compromised nodes injecting rogue routes or default gateways.</td></tr><tr><td>Enable ExecShield for Enhanced Memory Protection</td><td><strong>Enable ExecShield for Enhanced Memory Protection</strong> sets <code>kernel.exec-shield</code> in <code>/etc/sysctl.conf</code> to <code>2</code> when activated. This restricts execution in memory regions marked non-executable, hardening the system against buffer-overflow exploitation.</td></tr><tr><td>Restrict System Request (SysRq) Key Functions</td><td><strong>Restrict System Request (SysRq) Key Functions</strong> sets <code>kernel.sysrq</code> in <code>/etc/sysctl.conf</code> to <code>0</code> when activated, disabling the magic SysRq key. This removes a channel for low-level system control (such as forcing reboots or dumping memory) and thereby reduces the attack surface.</td></tr><tr><td>Comply with RFC1337 to Prevent TIME-WAIT Assassination</td><td><strong>Comply with RFC1337 to Prevent TIME-WAIT Assassination</strong> sets <code>net.ipv4.tcp_rfc1337</code> in <code>/etc/sysctl.conf</code> to <code>1</code> when activated. This makes the kernel drop RST packets for sockets in the TIME-WAIT state, limiting exposure to TIME-WAIT assassination attacks that would otherwise disrupt TCP connections.</td></tr><tr><td>Shorten TCP Keepalive Interval</td><td><strong>Shorten TCP Keepalive Interval</strong> sets <code>net.ipv4.tcp_keepalive_time</code> in <code>/etc/sysctl.conf</code> to <code>1800</code> seconds when activated, down from the default of 7200. Detecting dead connections sooner frees associated resources faster and reduces the window in which stale sockets can be abused.</td></tr></tbody></table>

***