hardening: sysctl: host / router config