# Ensure tcp syn cookies is enabled

Necessity: TCP SYN cookies are a crucial defense mechanism against SYN flood attacks, a common type of Denial-of-Service (DoS) attack. During a SYN flood, an attacker sends a high volume of TCP SYN packets, forcing the server to allocate resources for half-open connections. This can exhaust the server's connection queue (backlog), preventing it from accepting new, legitimate connections. When enabled, SYN cookies allow the server to handle SYN requests without adding entries to the backlog until a valid response is received, effectively mitigating the impact of such attacks. Disabling this feature leaves the server highly vulnerable to resource exhaustion and service disruption.

Auditing and Remediation: The audit script checks the live kernel parameter value of `net.ipv4.tcp_syncookies` to determine if it is enabled (1) or disabled (0). The remediation script modifies the system's persistent `sysctl` configuration to set `net.ipv4.tcp_syncookies` to '1', ensuring the setting is active and survives reboots.

Recommended State Rationale: The recommendation is consistent across all levels because this setting represents a binary choice with a clear security benefit. 
- Basic: ['1'] - Enabling SYN cookies is the minimum standard for any internet-facing server to protect against basic DoS attacks. 
- Moderate: ['1'] - There is no intermediate state for this setting; it is either on or off. The moderate recommendation remains '1' as it is a foundational security control. 
- Strict: ['1'] - The most secure configuration is to have this protection enabled. The performance overhead of SYN cookies is negligible in modern systems compared to the significant risk of a SYN flood attack. Therefore, it should always be enabled in a strict security environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `sysctl -n net.ipv4.tcp_syncookies` command to retrieve the current value of the TCP SYN cookies setting. The script must output only the numerical value (e.g., '1' or '0') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('1' for enabled, '0' for disabled) for the `net.ipv4.tcp_syncookies` kernel parameter. The script must set the parameter in the system's `sysctl` configuration (e.g., by writing to a file like `/etc/sysctl.d/99-syncookies.conf`) and apply it immediately using `sysctl -p`. The script must return 'true' on success and 'false' on failure.

