anchor.diff:  # This settings controls how the kernel behaves towards module changes at runtime. Setting to 1 will disable module loading at runtime.
   kernel.modules_disabled = <%= ((@node['security']['kernel']['enable_module_loading']) ? "0" : "1") %>
   
  -# Magic Sysrq should be disabled, but can also be set to a safe value if so desired for physical machines. It can allow a safe reboot if the system hangs and is a 'cleaner' alternative to hitting the reset button. 
  +# Magic Sysrq should be disabled, but can also be set to a safe value if so desired for physical machines. It can allow a safe reboot if the system hangs and is a 'cleaner' alternative to hitting the reset button.
   # The following values are permitted:
  -# 
  +#
   # * **0** - disable sysrq
   # * **1** - enable sysrq completely
   # * **>1** - bitmask of enabled sysrq functions:
  
positive.code: 
  
  # Define different modes for sending replies in response to received ARP requests that resolve local target IP addresses:
  # 
  # * **0** - (default): reply for any local target IP address, configured on any interface
  # * **1** - reply only if the target IP address is local address configured on the incoming interface
  # * **2** - reply only if the target IP address is local address configured on the incoming interface and both with the sender's IP address are part from same subnet on this interface
  
negative.code: net.ipv4.conf.default.shared_media = 1
  
  # Accepting source route can lead to malicious networking behavior, so disable it if not needed.
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.default.accept_source_route = 0
  
  # Accepting redirects can lead to malicious networking behavior, so disable it if not needed.
  