Slashdot Mirror
Securing FreeBSD 4.x STABLE
oscarcvt writes "While browsing through daily daemon news I found a story posted on Jan 4th that made reference to an article about securing FreeBSD 4.x. The article is titled 'A basic guide to securing FreeBSD 4.x-STABLE' . Everything from mounting ro to secure levels and lots of other stuff.
Happy secureading!"
This is what I really hate about Slashdotters, and especially Linux users, the no clue about security.
First, there is no such thing as a secure system, there are however trusted systems, how much trust you can put in a system and its proven that it will always hold true to that level.
The difference in security in the base systems is so small and irrelevant that the security of a box is more dependant on how well you know the system. If you use FreeBSD, use FreeBSD. If you use Linux, which I think sucks ass, use that one.
Dont get me wrong, I love all the BSDs and use them all, but its not the system that makes the level of trust you can put into it.
If you want security, use Trusted Solaris, OS/400 or OpenVMS.
With your obvious intelligence, I would've thought you would have had the more obvious answer... more secure than FreeBSD *and* OpenBSD! Just don't power the machine on!
Having tried both, I really don't feel that FreeBSD is really any less secure than Open if properly locked down. OpenBSD's motto is "secure out of the box", which, yes, is true. Its also got virtually every service locked out also. Run Apache and make it a webserver..whoops, its now only as secure as Apache is.
To anyone who *knows* how to secure a box, in general any OS can be made pretty secure, and this includes Free/Net/OpenBSD, Solaris, Linux, HP/UX, Irix... the list could go on.
But, for the best security in the world... install DOS 3.3 with no network drivers. Or just leave it turned off.
Can you tell I've hit this before?
It's FreeBSD nasty, why does not FreeBSD provide a sysctl to simply let root turn ctl+alt+del off? According to the article's "Secure the console", user can access console, they should let root to do the simple settings, at least it can prevent user from pressing ctl+alt+del to suddenly reboot machine! the user might not on purpose.
you can set the userdir to something else, e.g. /home/homepages
/home/homepages/user/bla.html
Then www.server.com/~user/bla.html ==
works like a charm here, all users have mod 700 homedirs and 755 homepagedirs.
How about some features OpenBSD provides such as an encrypted swap space?? I dont think FreeBSD provides that.
I agree with the claim that systems are not secure but trusted to a certain degree.
One more thing, if we take the BSD's, Linux, Solaris and install Apache there'd be no difference in security amongst these systems? I dont think so.
What are you securing?? winblows??
I've tried out linux and FreeBSD and I go for FreeBSD all the way. It's a unified project without a 1,000 handfulls of distros.
Its common sense not to rely on net surveys, and accounting for *BSD users based on USENET postings is a poor populational sample. A good introductory statistics course would fit you well.
You didn't mention daemonnews or apple? Do you think apple will let *BSD die after OS X is based on FreeBSD??
Being as FreeBSD is open source much of its greatness comes from OS hobbyists. It seems you don't know what you are talking about, or my eyes are selling me out! hopefully not to ms.
Fact: Your numeric skills are dead
Fact: *BSD is alive and rockin'
This is just my opinion. Nothing more.
.x release. Debian sounds the best, but it didn't even install on the computer I tried. Mandrake just died one day (no clue)...the os wouldn't boot and i just gave up. Slackware is good, but it doesn't seem to have the documentation of FreeBSD. I used to love Linux, until I used it. The biggest problems I have had are with dependencies and non-kernel related problems. I think a centrally managed OS like the BSD's are much more efficient. With kernel releases every few months for Linux, how can you expect it to be stable? I'm a business person. I value time and money. /stand/sysinstall is the greatest utility FreeBSD has. From that 1 utility I can change anything I need to. Simple as that. Redhat had utilities that don't even work right!
After trying to use Linux (redhat 6x/7x, mandrake 7x/8x, debian, slackware) I found that none were upgradeable as easy as FreeBSD. Try upgrading from Redhat 7.1 -> 7.2. I've had it fail on 3 different machines (at work). Nightmares doing that. Plus everything is changing on a
(Linux has always been very stable for me as a server. It runs into serious problems only when you start trying to make it into a desktop system and extensively use the X environment. In fact, X itself works just fine with a trimmed down window manager like fvwm. It's just not very "cool" or flashy, and not at all user-friendly when you need to add new items to menus.)
As a business user, I'd assume you're trying to use BSD (or Linux) in a server situation? If so, I'm not sure why you had so many issues with Linux. On the other hand, BSD installs all the basic stuff you need to run a very stable web, ftp, mail, news, etc. type of server - so I'm not faulting you at all for making that choice.
For myself, I find freebsd the os of choice for my servers, but as far as a desktop is concerned it pisses me off enormously that despite running on only one architecture and having only one distro, freebsd (4.4 stable) can't even set AA fonts up properly, key bindings in vim are fucked up etc.
BSD is just rock solid. It's easy to install, upgrade and use. It has been proven. I can't wait to use 4.5 and try it out. Linux is trying to emulate Windows, and it never will. Linux should find it's niche over time. I know BSD has and it's thriving. Doing everything for everyone is bad, and I know BSD isn't.
Conformity is the jailer of freedom and enemy of growth. -JFK
Hmm.. encrypted swap. So you slow down your swapping to encrypt/decrypt it... I dunno.
I wouldn't use it.
Besides, in order to get to swap someone must:
1) Gain login access & root on your machine
(and then you've got more serious problems).
2) Gain *physical* access to your machine.
(again, serious problems. What good is
encrypted swap when they can boot off CD,
break into your system, and have access to
all of your data files anyways?).
Based on? My god a you that stupid....
Apple OSX uses just FreeBSD shit because the stupid license will let it...
They rather used Linux, trust me...but since that is underr GPL...hehehe
Poer to the penguins!!
Ah..now i understand..Eric Raymond was talking about FreeBSD v5 not NT!
Please share your wonderful insights into the complex world of linux licensing!!
If you're sure why linux wasn't licensed to apple maybe you could tell us all why?
The real reason is *bsd is a better os in general!
fact: you are a wannabe newbie
Swap space is an archaic idea. The system should reserve an amount of RAM for the OS in low memory conditions and tell other programs they can't have any more. I haven't had a server run out of memory in a long time and I'm tired of X and netscrape swaping to the "never used unless theres a bug" swap space. Nothinkg like watching a program swap out a gig or so.
one of the things I really like about working with FreeBSD is the ability to very easily skinny-down the kernel.
... you can always reactivate it later if you need/want it
/etc/inetd.conf
usually if you've installed the kern-development or full set, go to
/usr/src/sys/i386/conf
copy GENERIC over to a new file and run through commenting out stuff you'll never use
don't need nfs? comment out
#options NFS #Network Filesystem
#options NFS_ROOT #NFS usable as root device, NFS required
consider making a CDROM based boot image instead of HD -- not as fast boot (well, relatively) but ultimately secure and the machine will always come up in case of HD crash/corruption
otherwise, if you don't have SCSI, dump them all! also, chop out any additional ethernet drivers, etc.
not only will you get a smaller kernel with "less moving parts" that boots faster, you'll have less of a finger print to hit
ipfilter is a must as well, and definitely shutdown all extra services in
and finally, regarding SSH -- set it up to accept root connections from specific hosts, and then add in tcpwrappers and/or ipfilters to help enforce that -- it helps to cut down on any future buffer-overrun attacks that may surface
Old age and treachery almost always overcome youth and skill.
much much nicer but infortunately in french (feel free to transalte :)
http://minithins.net/papers/FreeBSD.txt
This document has now been updated on his site to revision 1.8. There's quite a few changes and a bit more info now.