# Ensure tcp syn cookies is enabled

Necessity: TCP SYN cookies are a crucial defense mechanism against TCP SYN flood attacks, a common type of Denial-of-Service (DoS) attack. When a server's SYN backlog queue is full, enabling SYN cookies allows the system to respond to legitimate connection requests using a cryptographic cookie instead of dropping them. This ensures service availability and resilience under attack. Disabling this feature makes the system highly vulnerable to being overwhelmed by SYN flood traffic, leading to service unavailability for legitimate users. Auditing and Remediation: The audit script checks the current runtime value of the 'net.ipv4.tcp_syncookies' kernel parameter. The remediation script modifies this parameter by setting its value to '1', which enables the feature. It applies this change to the live kernel configuration and also saves it to a configuration file (e.g., within /etc/sysctl.d/) to ensure the setting persists after a system reboot. Recommended State Rationale: This is a binary security setting. Basic: The state is set to '1' (enabled), which is the minimum requirement to protect against SYN flood attacks. Moderate: The state remains '1'. There is no intermediate level of protection; the feature is either on or off. Strict: The state is '1'. For any server exposed to untrusted networks, this setting must be enabled. There is no more secure configuration than having it enabled, as disabling it introduces a significant and unnecessary security risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the value of the 'net.ipv4.tcp_syncookies' kernel parameter using 'sysctl -n net.ipv4.tcp_syncookies'. The script must output only the numerical value (e.g., '1') without any additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('1' for enabled). The script must use 'sysctl -w net.ipv4.tcp_syncookies=$1' to set the live value and also ensure the setting is made persistent across reboots by adding or updating 'net.ipv4.tcp_syncookies = $1' in a file within '/etc/sysctl.d/'. The script must output 'true' on success and 'false' on failure.

