anchor.diff:  net.ipv4.ip_forward = <%= ((@node['network']['forwarding']) ? "1" : "0") %>
   net.ipv6.conf.all.forwarding = <%= ((@node['network']['forwarding']) ? "1" : "0") %>
   
  -# Enable RFC-recommended source validation feature. It should not be used for routers on complex networks, but is helpful for end hosts and routers serving small networks.
  +# Enable RFC-recommended source validation feature. It should not be used for
  +# routers on complex networks, but is helpful for end hosts and routers serving
  +# small networks.
   net.ipv4.conf.all.rp_filter = 1
   net.ipv4.conf.default.rp_filter = 1
   
  -# Reduce the surface on SMURF attacks. Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
  +# Reduce the surface on SMURF attacks. Make sure to ignore ECHO broadcasts,
  +# which are only required in broad network analysis.
   net.ipv4.icmp_echo_ignore_broadcasts = 1
   
  -# There is no reason to accept bogus error responses from ICMP, so ignore them instead.
  +# There is no reason to accept bogus error responses from ICMP, so ignore them
  +# instead.
   net.ipv4.icmp_ignore_bogus_error_responses = 1
   
   # Limit the amount of traffic the system uses for ICMP.
   net.ipv4.icmp_ratelimit = 100
   
  -# Adjust the ICMP ratelimit to include: ping, dst unreachable, source quench, time exceed, param problem, timestamp reply, information reply
  +# Adjust the ICMP ratelimit to include: ping, dst unreachable, source quench,
  +# time exceed, param problem, timestamp reply, information reply
   net.ipv4.icmp_ratemask = 88089
   
   # Disable or Enable IPv6 as it is needed.
  
positive.code: net.ipv4.conf.all.shared_media = 1
  net.ipv4.conf.default.shared_media = 1
  
  # Accepting source route can lead to malicious networking behavior, so disable it if not needed.
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.default.accept_source_route = 0
  
  # Accepting redirects can lead to malicious networking behavior, so disable it if not needed.
  net.ipv4.conf.all.accept_redirects = 0
  net.ipv4.conf.default.accept_redirects = 0
  net.ipv6.conf.all.accept_redirects = 0
  
negative.code: # System
  # ------
  
  # This settings controls how the kernel behaves towards module changes at
  # runtime. Setting to 1 will disable module loading at runtime.
  kernel.modules_disabled = <%= ((@node['security']['kernel']['enable_module_loading']) ? "0" : "1") %>
  
  # Magic Sysrq should be disabled, but can also be set to a safe value if so
  # desired for physical machines. It can allow a safe reboot if the system hangs
  # and is a 'cleaner' alternative to hitting the reset button.
  # The following values are permitted:
  #
  # * **0**   - disable sysrq
  # * **1**   - enable sysrq completely
  # * **>1**  - bitmask of enabled sysrq functions:
  # * **2**   - control of console logging level
  # * **4**   - control of keyboard (SAK, unraw)
  # * **8**   - debugging dumps of processes etc.
  # * **16**  - sync command
  # * **32**  - remount read-only
  # * **64**  - signalling of processes (term, kill, oom-kill)
  # * **128** - reboot/poweroff
  # * **256** - nicing of all RT tasks
  kernel.sysrq = <%= ((@node['security']['kernel']['enable_sysrq']) ? "#{@node['security']['kernel']['secure_sysrq']}" : "0" ) %>
  
  # Prevent core dumps with SUID. These are usually only needed by developers and
  # may contain sensitive information.
  fs.suid_dumpable = <%= ((@node['security']['kernel']['enable_core_dump']) ? "1" : "0") %>
  