ASIMP :: Security Platform
ANSIBLE SYSTEM INTEGRITY MANAGEMENT PLATFORM // baselines & hardening
MODE:

Documentation

Home Gitbook & dsom summary index Asimp for ai agents: deep state of mind (dsom) protocol integration Ansible best practices & fqcn standards Ansible playbook and document architecture map Architecture & design Configuration & variables Review & adoption of dsom ansible configuration guide (v3.6.2) Diátaxis documentation framework Deep state of mind (dsom) governance framework System architecture & security posture Operational recipes index Execute tool workflows Legal notice & disclaimer Asimp local testing matrix & telemetry spec Lynis auditing & playbook analysis Openscap integration & playbook analysis Rootless podman 5+ & quadlet orchestration Asimp standard footer patcher reference Google okf frontmatter patcher reference Ansible config parameters reference Component & tool index Sovereign feedback collector reference Llm xml context compiler reference Role lynis ansible reference Mock scanning utility reference Openwiki emulator specification Sovereign os role patcher reference System core playbooks reference Jekyll pre processor reference Role reporting asimp reference Suse/sled sysctl hardening role reference Role update ubuntu asimp reference Sitemap & link integrity validator reference Local knowledge first & metadata discovery Troubleshooting & fallback behaviors Quickstart onboarding guide

Reports & SPA

Output of ASIMP Output of Lynis Output of OpenSCAP SPA Requirement Checklist

About ASIMP

ASIMP is an automated framework built with Ansible to assess host compliance, configure OS parameters, secure SSH, and verify integrity.

SUSE/SLED Sysctl Hardening Role Reference

Ansible >= 9.0.0 OpenSCAP: CIS L2 Lynis: Enabled debsums: Enabled

SUSE/SLED Sysctl Hardening Role Reference

The sysctl-suse-ASIMP Ansible role implements the network security sysctl recommendations from SUSE Linux Enterprise Desktop (SLED) 15 SP7 Security and Hardening Guide.

It applies kernel network parameter hardening and automatically scales resource limits (net.ipv4.tcp_max_syn_backlog and net.core.somaxconn) dynamically based on node RAM and vCPU capacity, while inspecting root disk size for telemetry.

📋 Features

  • RAM & vCPU Auto Resource Calculation: Dynamically measures RAM (ansible_facts['memtotal_mb']) and vCPU count (ansible_facts['processor_vcpus']) to calculate optimal network socket backlogs, while reporting root disk size (ansible_facts['mounts']) for node telemetry.
  • Configurable Auto-Calculation Gating: Automatic calculation can be toggled using suse_sysctl_auto_calc_resources (defaults to true). Disabling auto-calculation uses fixed default fallback values of 4096 (net.ipv4.tcp_max_syn_backlog) and 1024 (net.core.somaxconn), while explicit overrides (suse_sysctl_override_tcp_max_syn_backlog and suse_sysctl_override_somaxconn) take precedence in both modes.
  • Deduplicated Network Hardening: Consolidates SUSE/SLED network sysctl settings into /etc/sysctl.d/99-suse-network-hardening.conf without duplicate entries.
  • Standalone or Integrated Playbook Execution: Scope is restricted to hosts where ansible_distribution is SUSE, SLES, SLED, openSUSE or ansible_os_family is Suse, and version is 15.7. It can be executed standalone via playbooks/suse_sysctl.yml or as part of play.yml / play-localhost.yml pipeline on SUSE/SLED 15.7 hosts after OpenSCAP and Lynis hardening steps.
  • Sandbox Safety Protocols: Respects asimp_privilege_level (‘full’ vs ‘limited’) and gracefully skips unprivileged container failures in Google Jules sandboxes.

⚙️ Configured Kernel Parameters

The role applies the following standardized configuration in /etc/sysctl.d/99-suse-network-hardening.conf:

Parameter Value Description
net.ipv4.conf.default.rp_filter 1 Strict reverse path filtering
net.ipv4.conf.all.rp_filter 1 Strict reverse path filtering for all interfaces
net.ipv4.conf.default.accept_source_route 0 Reject source routed packets
net.ipv4.conf.all.accept_source_route 0 Reject source routed packets for all interfaces
net.ipv4.tcp_syncookies 1 Enable TCP SYN Cookie protection
net.ipv4.tcp_max_syn_backlog Auto-calculated Dynamic queue size (base 4096, scales with RAM & vCPUs)
net.core.somaxconn Auto-calculated Dynamic listen socket limit (base 1024, scales with RAM & vCPUs)
net.ipv4.icmp_echo_ignore_broadcasts 1 Ignore ICMP broadcast pings
net.ipv4.icmp_ignore_bogus_error_responses 1 Ignore invalid ICMP error responses
net.ipv4.conf.default.accept_redirects 0 Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects 0 Disable ICMP redirect acceptance for all interfaces
net.ipv6.conf.default.accept_redirects 0 Disable IPv6 ICMP redirect acceptance
net.ipv6.conf.all.accept_redirects 0 Disable IPv6 ICMP redirect acceptance for all interfaces
net.ipv4.conf.default.secure_redirects 0 Disable secure ICMP redirects
net.ipv4.conf.all.secure_redirects 0 Disable secure ICMP redirects for all interfaces
net.ipv4.conf.default.send_redirects 0 Disable ICMP redirect sending
net.ipv4.conf.all.send_redirects 0 Disable ICMP redirect sending for all interfaces
net.ipv4.ip_forward 0 Disable IPv4 packet forwarding
net.ipv6.conf.all.forwarding 0 Disable IPv6 packet forwarding
net.ipv6.conf.default.forwarding 0 Disable IPv6 packet forwarding for defaults
net.ipv4.conf.all.log_martians 1 Log martian packets
net.ipv4.conf.default.log_martians 1 Log default martian packets

🚀 Standalone Execution

To execute this sysctl hardening playbook independently on target hosts:

ansible-playbook -i inventory/hosts.yml playbooks/suse_sysctl.yml
ASIMP (Ansible System Integrity Management Platform) Deep State of Mind (DSOM) For My AI Protocol Harisfazillah Jamel (LinuxMalaysia) 2026-07-12 Standard: UK English DBP-standard Bahasa Melayu Malaysia (Piawai) GNU General Public License v3.0 Legal Notice & Disclaimer