Essential Linux Performance & Security Tuning: Sysctl Settings Explained

Linux distributions use conservative defaults to ensure compatibility, but many settings can be tuned for better performance and security.

Disk Subsystem Optimization

Disable file access time logging by adding noatime to the fourth column in /etc/fstab, reducing unnecessary disk writes.

Network Tuning

Adjust TCP keepalive and backlog parameters to free resources faster:

net.ipv4.tcp_keepalive_time = 7200

net.ipv4.tcp_keepalive_intvl = 75

net.ipv4.tcp_keepalive_probes = 9

net.core.netdev_max_backlog = 3000

net.ipv4.tcp_max_syn_backlog = 1024

net.ipv4.tcp_synack_retries = 5

net.ipv4.tcp_retries2 = 15

Enable SYN cookies to mitigate SYN flood attacks:

net.ipv4.tcp_syncookies = 1

Security‑related Sysctl Settings

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 1

net.ipv4.conf.all.send_redirects = 0

net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_echo_ignore_all = 1

net.ipv4.icmp_ignore_bogus_error_responses = 1

TCP Connection Management

Reuse TIME‑WAIT sockets and shorten their lifetimes:

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_fin_timeout = 30

Memory and Buffer Settings

net.ipv4.core.wmem_max = 8388608

net.ipv4.core.rmem_max = 8388608

net.ipv4.tcp_rmem = "4096 87380 8388608"

net.ipv4.tcp_wmem = "4096 87380 8388608"

File Descriptor Limits

Increase per‑process limits with ulimit or by editing /etc/security/limits.conf: ulimit -u 10000 # max processes ulimit -n 4096 # max open files

* soft nofile 8192

* hard nofile 20480

Firewall Rules

iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

These adjustments collectively improve Linux server throughput, reduce resource waste, and harden the system against common network attacks.