Slashdot Mirror
Securing FreeBSD 4.x STABLE
oscarcvt writes "While browsing through daily daemon news I found a story posted on Jan 4th that made reference to an article about securing FreeBSD 4.x. The article is titled 'A basic guide to securing FreeBSD 4.x-STABLE' . Everything from mounting ro to secure levels and lots of other stuff.
Happy secureading!"
This is what I really hate about Slashdotters, and especially Linux users, the no clue about security.
First, there is no such thing as a secure system, there are however trusted systems, how much trust you can put in a system and its proven that it will always hold true to that level.
The difference in security in the base systems is so small and irrelevant that the security of a box is more dependant on how well you know the system. If you use FreeBSD, use FreeBSD. If you use Linux, which I think sucks ass, use that one.
Dont get me wrong, I love all the BSDs and use them all, but its not the system that makes the level of trust you can put into it.
If you want security, use Trusted Solaris, OS/400 or OpenVMS.
Can you tell I've hit this before?
This is just my opinion. Nothing more.
.x release. Debian sounds the best, but it didn't even install on the computer I tried. Mandrake just died one day (no clue)...the os wouldn't boot and i just gave up. Slackware is good, but it doesn't seem to have the documentation of FreeBSD. I used to love Linux, until I used it. The biggest problems I have had are with dependencies and non-kernel related problems. I think a centrally managed OS like the BSD's are much more efficient. With kernel releases every few months for Linux, how can you expect it to be stable? I'm a business person. I value time and money. /stand/sysinstall is the greatest utility FreeBSD has. From that 1 utility I can change anything I need to. Simple as that. Redhat had utilities that don't even work right!
After trying to use Linux (redhat 6x/7x, mandrake 7x/8x, debian, slackware) I found that none were upgradeable as easy as FreeBSD. Try upgrading from Redhat 7.1 -> 7.2. I've had it fail on 3 different machines (at work). Nightmares doing that. Plus everything is changing on a
(Linux has always been very stable for me as a server. It runs into serious problems only when you start trying to make it into a desktop system and extensively use the X environment. In fact, X itself works just fine with a trimmed down window manager like fvwm. It's just not very "cool" or flashy, and not at all user-friendly when you need to add new items to menus.)
As a business user, I'd assume you're trying to use BSD (or Linux) in a server situation? If so, I'm not sure why you had so many issues with Linux. On the other hand, BSD installs all the basic stuff you need to run a very stable web, ftp, mail, news, etc. type of server - so I'm not faulting you at all for making that choice.
For myself, I find freebsd the os of choice for my servers, but as far as a desktop is concerned it pisses me off enormously that despite running on only one architecture and having only one distro, freebsd (4.4 stable) can't even set AA fonts up properly, key bindings in vim are fucked up etc.
BSD is just rock solid. It's easy to install, upgrade and use. It has been proven. I can't wait to use 4.5 and try it out. Linux is trying to emulate Windows, and it never will. Linux should find it's niche over time. I know BSD has and it's thriving. Doing everything for everyone is bad, and I know BSD isn't.
Conformity is the jailer of freedom and enemy of growth. -JFK
one of the things I really like about working with FreeBSD is the ability to very easily skinny-down the kernel.
... you can always reactivate it later if you need/want it
/etc/inetd.conf
usually if you've installed the kern-development or full set, go to
/usr/src/sys/i386/conf
copy GENERIC over to a new file and run through commenting out stuff you'll never use
don't need nfs? comment out
#options NFS #Network Filesystem
#options NFS_ROOT #NFS usable as root device, NFS required
consider making a CDROM based boot image instead of HD -- not as fast boot (well, relatively) but ultimately secure and the machine will always come up in case of HD crash/corruption
otherwise, if you don't have SCSI, dump them all! also, chop out any additional ethernet drivers, etc.
not only will you get a smaller kernel with "less moving parts" that boots faster, you'll have less of a finger print to hit
ipfilter is a must as well, and definitely shutdown all extra services in
and finally, regarding SSH -- set it up to accept root connections from specific hosts, and then add in tcpwrappers and/or ipfilters to help enforce that -- it helps to cut down on any future buffer-overrun attacks that may surface
Old age and treachery almost always overcome youth and skill.