the latest pci compliance rules require disabling tcp timestamps as described in rfc1323 and rfc7323. is it possible to configure either aws api-gateway or the associated cloudfront proxy to disable this feature?
details:
the typical way to disable this feature on a linux server is to run this command: sysctl -w net.ipv4.tcp_timestamps=0
the latest pci compliance specification can be found here: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf
side note: it appears that aws randomizes the tcp timestamps on a per-connection basis to prevent an attacker from detecting server restarts, but i can’t find any documentation to support this theory. is there any such documentation?
4