Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
Enables TCP SYN cookies as a SYN-flood defense by setting net.ipv4.tcp_syncookies to 1.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A TCP SYN flood attack causes denial of service by filling the system's TCP connection table with half-open connections in the SYN_RCVD state. SYN cookies let the kernel validate a connection from the subsequent ACK without keeping per-connection state, confirming the initiator is making a valid connection rather than a flood source. The mechanism only activates under flood conditions, so the system keeps servicing legitimate connection requests.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv4.tcp_syncookies'), reflecting the running kernel after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime overrides are merged. A static read of /etc/sysctl.conf can miss a drop-in or sysctl -w that changed the effective value.
describe kernel_parameter('net.ipv4.tcp_syncookies') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.tcp_syncookies[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.tcp_syncookies and expect net.ipv4.tcp_syncookies = 1.
Inspect & investigate
Confirm with sysctl net.ipv4.tcp_syncookies. When the defense triggers, the kernel logs possible SYN flooding on port N. Sending cookies., view it with journalctl -k | grep -i syn or dmesg | grep -i syn. SYN-cookie counters are visible in nstat -az | grep -i syncookie.
Remediation
Pavois's harden plan sets net.ipv4.tcp_syncookies = 1 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.tcp_syncookies |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe and strongly recommended for any host that accepts inbound TCP; most distributions enable it by default. Precaution: SYN cookies are only engaged under flood pressure, and in that mode certain TCP options (e.g. large windows / window scaling) negotiated in the original SYN may be lost for those connections, an acceptable trade-off versus a denial of service. No impact under normal load.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 1.4.3, 3.3.10, 3.3.1.18 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-5(1), SC-5(2), SC-5(3)(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.3 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-253010, UBTU-24-600190 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.