[hbsd14] fix(resolv): nameserver in jails #110
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,90 +1,92 @@ | ||||||
| # http://netlab.dhis.org/download/software/os_cfg/FBSD/13/base/etc/sysctl.conf | ||||||
| # http://netlab.dhis.org/download/software/os_cfg/FBSD/14/base/etc/sysctl.conf | ||||||
|
|
||||||
| kern.coredump=0 # Disable core dumps (prevents leaking sensitive memory data) | ||||||
| kern.ipc.maxsockbuf=67108864 # Maximum socket buffer size (64 MB) | ||||||
| kern.ipc.soacceptqueue=4096 # Max listen queue depth for TCP connections | ||||||
|
|
||||||
| kern.ipc.shm_use_phys=1 # Lock shared memory segments in RAM (avoid swapping, improve IPC perf) | ||||||
| kern.maxfiles=204800 # System-wide open file descriptor limit | ||||||
| kern.maxfilesperproc=128000 # Per-process open file descriptor limit | ||||||
| kern.maxprocperuid=64000 # Maximum number of processes per user ID | ||||||
| kern.maxvnodes=250000 # Maximum number of vnodes (filesystem inode cache) | ||||||
| kern.sched.interact=5 # Scheduler interactivity bias (lower = less interactive favoring) | ||||||
| kern.sched.slice=1 # Scheduler time slice (ms) | ||||||
| kern.sugid_coredump=0 # Disable core dumps for setuid/setgid binaries | ||||||
| kern.threads.max_threads_per_proc=4096 # Max threads per process | ||||||
| kern.msgbuf_show_timestamp=1 # Include timestamps in kernel message buffer (dmesg) | ||||||
|
|
||||||
| net.inet.carp.log=1 # Enable CARP (failover) logging | ||||||
| net.inet.carp.preempt=1 # Allow CARP preemption for faster master failover | ||||||
|
|
||||||
| net.inet.ip.intr_queue_maxlen=4096 # Max length of IP input queue | ||||||
| net.inet.ip.maxfragpackets=0 # Disable fragmented packet reassembly (DoS protection) | ||||||
| net.inet.ip.maxfragsperpacket=0 # Limit per-packet fragmentation | ||||||
| net.inet.ip.process_options=0 # Ignore IP options (security hardening) | ||||||
| net.inet.ip.random_id=1 # Randomize IP ID field (prevent fingerprinting) | ||||||
| net.inet.ip.redirect=0 # Ignore ICMP redirects (anti-MITM) | ||||||
| net.inet.ip.sourceroute=0 # Disable source routing | ||||||
| net.inet.ip.accept_sourceroute=0 # Refuse source-routed packets | ||||||
| net.inet.ip.ttl=128 # Default IP Time-To-Live value | ||||||
|
|
||||||
| net.inet.icmp.maskrepl=0 # Do not reply to ICMP address mask requests | ||||||
| net.inet.icmp.log_redirect=0 # Do not log ICMP redirects | ||||||
| net.inet.icmp.drop_redirect=1 # Drop ICMP redirects entirely | ||||||
|
|
||||||
| net.inet.tcp.abc_l_var=44 # Adjust congestion control ABC variable (RFC 3465) | ||||||
|
|
||||||
| net.inet.tcp.always_keepalive=0 # Disable global TCP keepalive, let apps decide | ||||||
|
|
||||||
| net.inet.tcp.nolocaltimewait=1 # Skip TIME_WAIT for loopback connections | ||||||
|
|
||||||
| net.inet.tcp.delayed_ack=1 # Delay ACKs to piggyback with outgoing data | ||||||
| net.inet.tcp.blackhole=2 # Drop TCP packets to closed ports (no RST) | ||||||
| net.inet.tcp.drop_synfin=1 # Drop packets with SYN+FIN flags (scans/attacks) | ||||||
| net.inet.tcp.ecn.enable=1 # Enable Explicit Congestion Notification (RFC 3168) | ||||||
| # deprecated in 14.x -> | ||||||
| net.inet.tcp.fast_finwait2_recycle=1 # Recycle FIN_WAIT_2 sockets faster | ||||||
| net.inet.tcp.icmp_may_rst=0 # Do not reset TCP on ICMP errors | ||||||
| net.inet.tcp.initcwnd_segments=44 # Initial congestion window size (segments) | ||||||
| net.inet.tcp.isn_reseed_interval=4500 # ISN generator reseed interval (sec) | ||||||
| net.inet.tcp.keepcnt=3 # Number of keepalive probes before closing | ||||||
| net.inet.tcp.keepidle=10000 # Idle time before first keepalive (ms) | ||||||
| net.inet.tcp.keepintvl=5000 # Interval between keepalive probes (ms) | ||||||
| net.inet.tcp.minmss=536 # Minimum TCP MSS | ||||||
| net.inet.tcp.msl=5000 # Maximum Segment Lifetime (ms) | ||||||
| net.inet.tcp.recvbuf_auto=1 # Enable automatic receive buffer tuning | ||||||
| net.inet.tcp.recvbuf_max=16777216 # Max receive buffer size (16 MB) | ||||||
| net.inet.tcp.sendbuf_auto=1 # Enable automatic send buffer tuning | ||||||
| net.inet.tcp.sendbuf_inc=131072 # Incremental send buffer growth step (128 KB) | ||||||
| net.inet.tcp.sendbuf_max=16777216 # Max send buffer size (16 MB) | ||||||
| net.inet.tcp.syncache.rexmtlimit=0 # Disable SYN cache retransmit limit | ||||||
| net.inet.tcp.syncookies=0 # Disable SYN cookies (only needed during SYN flood) | ||||||
| net.inet.tcp.tso=0 # Disable TCP Segmentation Offload (can cause driver issues) | ||||||
|
|
||||||
| net.inet.udp.blackhole=1 # Drop UDP packets to closed ports (no ICMP unreachable) | ||||||
|
|
||||||
| net.inet6.icmp6.nodeinfo=0 # Disable ICMPv6 Node Information responses | ||||||
| net.inet6.icmp6.rediraccept=0 # Reject ICMPv6 redirects | ||||||
| net.inet6.ip6.accept_rtadv=0 # Disable IPv6 Router Advertisements (no autoconf) | ||||||
| # read-only now, use ifconfig instead -> | ||||||
| net.inet6.ip6.auto_linklocal=0 # Do not auto-generate link-local addresses | ||||||
| net.inet6.ip6.maxfragpackets=0 # Disable IPv6 fragment reassembly | ||||||
| net.inet6.ip6.maxfrags=0 # Limit fragment buffer usage | ||||||
| net.inet6.ip6.prefer_tempaddr=1 # Prefer temporary (privacy) addresses | ||||||
| net.inet6.ip6.use_tempaddr=1 # Enable IPv6 temporary address generation | ||||||
| net.inet6.ip6.use_deprecated=0 # Do not use deprecated IPv6 addresses | ||||||
|
|
||||||
| net.local.dgram.maxdgram=65535 # Max datagram size for UNIX domain sockets | ||||||
| net.local.dgram.recvspace=65535 # Receive buffer size for UNIX domain sockets | ||||||
|
|
||||||
| security.bsd.hardlink_check_gid=1 # Prevent hardlinking across GIDs (privilege restriction) | ||||||
| security.bsd.hardlink_check_uid=1 # Prevent hardlinking across UIDs (mitigate privilege escalation) | ||||||
| security.bsd.see_other_gids=0 # Hide processes of other GIDs (isolation) | ||||||
| security.bsd.see_other_uids=0 # Hide processes of other UIDs (privacy) | ||||||
| security.bsd.stack_guard_page=1 # Enable stack guard page (stack overflow protection) | ||||||
| security.bsd.unprivileged_proc_debug=0 # Disallow ptrace/debug on other users’ processes | ||||||
| security.bsd.unprivileged_read_msgbuf=0 # Prevent non-root users from reading kernel message buffer | ||||||
|
|
||||||
| vfs.zfs.bclone_enabled=1 # Allows shallow copies of data blocks (introduced in OpenZFS 2.2). | ||||||
|
Member
Author
There was a problem hiding this comment. Take a moment to identify the need of this setting please.
Member
There was a problem hiding this comment. I prefer not enabling this for now, as it could cause unexpected problems
Suggested change
|
||||||
| vfs.zfs.vdev.async_read_max_active=6 # Max active async ZFS reads per vdev | ||||||
| vfs.zfs.vdev.sync_read_max_active=20 # Max active sync ZFS reads per vdev | ||||||
| vfs.read_max=128 # Max number of blocks per read-ahead operation | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can delete my sources if needed.