anchor.diff:  net.ipv4.conf.all.shared_media = 1
   net.ipv4.conf.default.shared_media = 1
   
  -# Accepting source route can lead to malicious networking behavior, so disable it if not needed.
  +# Accepting source route can lead to malicious networking behavior, so disable
  +# it if not needed.
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
  -# Accepting redirects can lead to malicious networking behavior, so disable it if not needed.
  +# Accepting redirects can lead to malicious networking behavior, so disable
  +# it if not needed.
   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   net.ipv6.conf.all.accept_redirects = 0
  
positive.code: # System
  # ------
  
  # This settings controls how the kernel behaves towards module changes at runtime. Setting to 1 will disable module loading at runtime.
  kernel.modules_disabled = <%= ((@node['security']['kernel']['enable_module_loading']) ? "0" : "1") %>
  
  # Magic Sysrq should be disabled, but can also be set to a safe value if so desired for physical machines. It can allow a safe reboot if the system hangs and is a 'cleaner' alternative to hitting the reset button.
  # The following values are permitted:
  #
  # * **0** - disable sysrq
  # * **1** - enable sysrq completely
  # * **>1** - bitmask of enabled sysrq functions:
  # * **2** - control of console logging level
  # * **4** - control of keyboard (SAK, unraw)
  # * **8** - debugging dumps of processes etc.
  # * **16** - sync command
  # * **32** - remount read-only
  # * **64** - signalling of processes (term, kill, oom-kill)
  # * **128** - reboot/poweroff
  # * **256** - nicing of all RT tasks
  kernel.sysrq = <%= ((@node['security']['kernel']['enable_sysrq']) ? "#{@node['security']['kernel']['secure_sysrq']}" : "0" ) %>
  
  # Prevent core dumps with SUID. These are usually only needed by developers and may contain sensitive information.
  fs.suid_dumpable = <%= ((@node['security']['kernel']['enable_core_dump']) ? "1" : "0") %>
  
negative.code: net.ipv4.ip_forward = <%= ((@node['network']['forwarding']) ? "1" : "0") %>
  net.ipv6.conf.all.forwarding = <%= ((@node['network']['forwarding']) ? "1" : "0") %>
  
  # Enable RFC-recommended source validation feature. It should not be used for
  # routers on complex networks, but is helpful for end hosts and routers serving
  # small networks.
  net.ipv4.conf.all.rp_filter = 1
  net.ipv4.conf.default.rp_filter = 1
  
  # Reduce the surface on SMURF attacks. Make sure to ignore ECHO broadcasts,
  # which are only required in broad network analysis.
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  
  # There is no reason to accept bogus error responses from ICMP, so ignore them
  # instead.
  net.ipv4.icmp_ignore_bogus_error_responses = 1
  
  # Limit the amount of traffic the system uses for ICMP.
  net.ipv4.icmp_ratelimit = 100
  
  # Adjust the ICMP ratelimit to include: ping, dst unreachable, source quench,
  # time exceed, param problem, timestamp reply, information reply
  net.ipv4.icmp_ratemask = 88089
  
  # Disable or Enable IPv6 as it is needed.
  