harden_sysctl() {
    CONF="/etc/sysctl.d/99-hardening.conf"
    SNAP=$(backup_create sysctl "$CONF")

    cat > "$CONF" <<EOF
net.ipv4.conf.all.accept_redirects = 0
kernel.kptr_restrict = 2
fs.protected_symlinks = 1
EOF

    sysctl --system || rm -f "$CONF"
    pause
}