Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Operating Systems Security Software BSD

Installing A Secure FreeBSD Box 131

Posted by timothy from the glue-the-case-shut dept.
ltwally writes "The guys over at LittleWhiteDog have a how-to on securing FreeBSD. Topics range from the basics to custom kernels, blowfish encryption, smtp, and custom firewall scripts. Definitely worth a look if you're running a FreeBSD box, or are interested in *nix security in general."
This discussion has been archived. No new comments can be posted.

Installing A Secure FreeBSD Box More

Installing A Secure FreeBSD Box

Comments Filter:

  • One thing I hate... (Score:2, Interesting)

    by MazTaim ( 1376 )
    I don't mind opinions, but for heaven's sake...BACK THEM UP!!!

    "And the best part is, things are easily installed and kept up to date, unlike your Linux systems out there. Don't get me wrong, Linux is great and all, but about 75% of the packages I install are custom based and, well, RedHat sucks when it comes to that."

    Never heard of Gentoo? How about LFS? How about downloading the source and compiling it yourself?

    "What's so bad about the Linux updating system?

    Well, you need to keep in mind that the BSD d

    • Re:One thing I hate... (Score:2, Funny)

      by Anonymous Coward

      Well, you need to keep in mind that the BSD distros are mostly source-based, from the packages you install to updating the operating system."

      I didn't know that packages in FreeBSD were actually source! I thought ports were source?

      No no no, the author means that BSD programs originate with source code which is then compiled and distributed via packages, whereas linux binaries are generated by 1 million monkeys randomly typing bits until something useful emerges.

      Hence, nothing in linux comes from source

    • Re:One thing I hate... (Score:4, Insightful)

      by scrytch ( 9198 ) <chuck@myrealbox.com> on Tuesday September 23, 2003 @08:33AM (#7033184)
      > Never heard of Gentoo? How about LFS? How about downloading the source and compiling it yourself?

      First: Haven't heard of LFS, so please elucidate. TLA's don't google well (now there's an idiomatic phrase). As for downloading and compiling the source: that's precisely what ports do. More to the point that they download, patch, configure, compile, package, and install automatically but that you can manually intervene in any of these steps, and that you need only edit very modular and flexible makefiles to do so. Gentoo requires a special tool, and if emerge doesn't fit your needs for one purpose or another for a particular package, let's hope you're a very dedicated python hacker. There's a lot of very neat stuff portage does but it looks to have started complex, not based on anything all that simple or flexible.

      > I didn't know that packages in FreeBSD were actually source! I thought ports were source?

      Packages are binaries. Ports builds and installs a package. If you want custom, you just cd to the work/src/ directory and you have the source tree just like the author made it (modulo any patches) from which you're free to do the usual configure && make before going up to the port dir and doing a "make package" (or just "make install" if you want to auto install it). Compare this to the tedium of customizing a source RPM.

      • Haven't heard of LFS, so please elucidate.

        Linux From Scratch [linuxfromscratch.org], a source-based disto. I used it for a while, and was quite happy with it, right up until I needed to uninstall some stuff.

      • There's also a BSD from scratch somewhere (google). But what I wanted to add was that portage is modeled after pkgsrc's (NetBSD) way.

        It's not that different from ports, ports integrated with portupgrade is about the same thing in functionality (only portage allows more than one version installed at a time but I'm not sure if that's really an advantage because it's also an invitation to breakage).

        make world somewhat resembles emerge world or emerge system or whatever it was called (I played with it briefly

  • Interesting (Score:3, Insightful)

    by pkplex ( 535744 ) on Monday September 22, 2003 @09:34PM (#7030528) Homepage
    But unless one really needs something special out of FreeBSD ( eg, SMP ) why not start with OpenBSD?

    OpenBSD's security is alot more than just services disabled by default, and is usefull well beyond a firewall. /me likes OpenBSD :)

    • A reason (Score:1, Interesting)

      by Anonymous Coward
      An objection I have to the 'standard' OpenBSD install is the 'kill a process with processor time' problem.

      Named - running along fine than BLAM! Dead process.
      Or rsync as another example.

      I understand the 'why' - denial of service concerns via run away processes. But to deny a service you want by killing it? Naw, sorry. The cure is worse than the problem.

    • Re:Interesting (Score:3, Interesting)

      by rsax ( 603351 )
      1. Hardware Support: If a vendor chooses to support a piece of hardware for a BSD OS (beyond Windows, Mac and maybe Linux) then most likely it will be FreeBSD.
      2. Jails: Man page [freebsd.org]
      3. Applications: FreeBSD has way more ports than OpenBSD. Whether someone uses most of them or not is another topic, but chances are what you need you will probably find ported for FreeBSD already
      4. FreeBSD 5.* onward: Nuff said

      FreeBSD and NetBSD are just as secure as OpenBSD so stick with what you're comfortable with. As for new us

      • RSAX wrote:

        Applications: FreeBSD has way more ports than OpenBSD.

        That's all fine and dandy. But the article was talking about SECURING FREEBSD. Installing ports is pretty much guaranteed to UNsecure FreeBSD (or Net, or Open...)

        FreeBSD and NetBSD are just as secure as OpenBSD

        Is that your opinion or are you willing to back that up with errata logs? Are you sure that Free/Net has had no more than one remote exploit in more than seven years?

        and pf doesn't count since it's already ported or being p

      • FreeBSD and NetBSD are just as secure as OpenBSD

        You might also say that Windows 95 and Windows 98 are just as secure as Windows 2000.

    • Because Theo is bordering on being just as annoying as RMS?

  • Interesting piece, but (Score:5, Insightful)

    by Anonymous Coward on Monday September 22, 2003 @09:45PM (#7030596)
    ...still needs work.

    NitPick 1: a cvsup cron job every 3 hours? Cvsup traffic is always high at the top of the hour because everyone does this. Fix: Look at the second hand / second readout on your watch right now. Pick that value as the minute your cron job does its thing. It's a simple psuedo-randomizer that makes things a little easier on the cvsup.freebsd.org servers.

    NitPick 2: a cvsup cron job every 3 hours? (Is there an echo?) freefall.freebsd.org is the authoritative cvsup source. Its only client is cvs-master.freebsd.org, which checks freefall every 6 minutes. Official mirrors are allowed access to cvs-master, and generally update between 1 hour and 4 hours. If you're updating more often than once a day via cron, maybe you need to think about becoming a mirror. Besides, the smart thing to do is do a cvsup on your src and ports trees and keep it back a day and watch the mail lists to see if anyone else's machine burnt their toast. If there aren't (m)any complaints, go for it.

    Nit 3: An official warning and a gruff "who the heck are you" getty message aren't going to keep kids from nmapping you. Try Fooling Nmap for Whatever Reason. [slashdot.org] If you're worried your OS and your kernel version will give you away, maybe you aren't keeping as up-to-date on your security lists?

    Nit 4: Sendmail. Sure. You could run sendmail, but why not look into qmail [qmail.org], written by djb. While you're there, check out djbdns [djbdns.org] if you need DNS services.
    • Nit 4: Sendmail. Sure. You could run sendmail, but why not look into qmail, written by djb. While you're there, check out djbdns if you need DNS services.

      Actually, a bit further down they the author recommends postfix. But gee, there is just so much ground to cover here, splitting this up would be good.
    • RTFM. 0 3 * * * means 3am every morning. HTH. HAND.
    • Good points. The author strikes me as a bit of a dipschnitzel anyway. I run Free- Net- and OpenBSD on different machines, and they all have their worth. Pick the right tool for the right job.

      One line that made me laugh was ". . .standalone server. . ." Golly, if your server doesn't hook up to any other machines, is it really a server?

      I think not.

  • Using FreeBSD as a firewall (Score:2, Funny)

    by Anonymous Coward
    Recently I had an experience to use FreeBSD. I had heard many great
    things about it, and was excited to replace a dead Linux firewall with
    this OS. Unfortunately as things turned out, FreeBSD proved to be more
    nightmare than solution.

    When not attending classes at my community college to get my
    humanities degree, I work part-time at a printshop. Our Linux box
    there finally gave up the ghost. I'd heard that FreeBSD was incredibly
    secure so I talked my boss into putting that on as a replacement.

    Part of the appeal

  • Security (Score:4, Funny)

    by rf0 ( 159958 ) <rghf@fsck.me.uk> on Tuesday September 23, 2003 @03:33AM (#7031973) Homepage
    Well taking recent events remove ssh and sendmail. Access via telnet only. No one will ever see my password that way

    Rus

  • here's something exciting for the mods (Score:3, Funny)

    by xluserpetex ( 666816 ) on Tuesday September 23, 2003 @03:42AM (#7032002)
    *generic BSD troll*

  • Nice and comprehensive (and the obvious but) (Score:5, Insightful)

    by dodell ( 83471 ) <dodell@nOsPaM.sitetronics.com> on Tuesday September 23, 2003 @04:32AM (#7032150) Homepage
    This is one of the most comprehensive articles I've ever seen about locking down a FreeBSD box. It covers stuff I didn't expect, including using schg to deny the ability to overwrite files.

    The but is that I felt it could have included more information about *why* you'd do these kinds of things instead of just how. This information would help people who are newer to FreeBSD understand how to expand on this. While it is comprehensive, I feel it could give people a little more idea of the 'why' rather than the 'how' so that people could do some securing of their own :).

    • devil is in the details (Score:4, Interesting)

      by epine ( 68316 ) on Tuesday September 23, 2003 @08:11AM (#7033051)

      This request is outrageous. There is any amount of material on the net already about security theory and practice. I've read most of it myself. How much of it am I practicing myself? Not very much. I'm not a full time sysadmin, I sysadmin during my recess breaks from my development activities. Why do I not bother to take security measures I hear preached on every street corner? Because the devil is in the details, and I can't afford to have my FreeBSD server go offline because ICMP was accomplishing something I didn't know about.

      This guide is more useful to me than another dozen sermons. It gives me confidence that I can lock down aspects of the system I don't have time to understand in depth with a modicum of confidence that the essential functions of my box will continue to perform.

      In my development life there are some aspects of security I work with daily: OpenSSH (tunnels, authpf), OpenSSL, IPsec. Despite my meager time budget to practice host-based security, I'm far from clueless about good security practices.

      Do people forget what an incredible sinkhole of human productivity security has become? A simple overview of X.509 destroyed a week of my time. Yet another horror show more easily avoided in theory than practice.

      One of the problems with Google is that you never see the thickness of the fully assembled tome. I recall an era where system documentation was measured in shelf-feet. Whenever I had the urge to make my life more complicated than necessary, I just had to look at that bookshelf and ask myself "do I really want to go there?"

      I'm at the point in my life where I'm never again going to set aside whole days to master intricacies like all the special perm bits on the FreeBSD implementation of FFS.

      I cherish the people out there who return from the trenches with a tattered cheat sheet with the barbed wire, machine gun nests, and landmine locations carefully documented. And then I read highly rated comments from the Rear Admiral types that "this is all well and good, but it isn't another volume of War and Peace". I would love to find to a complete set of VAX manuals on Ebay to donate to this idiot, but I don't think I could afford the shipping charge.

      What this article needs is not more theory, but more warnings about "if you experience this kind of problem after making these changes, you took your security measures too far too fast". The art of security is not in knowing what you ought to be doing, it's knowing *what you get away with hardening* given other constraints, such as having any time left over to accomplish something productive.

      I always remember the famous quote about building the Fermilab accelerator. When challenged about how Fermilab improved national security, someone shot back: Fermilab is the kind of project that makes America *worth* defending. People and nations who can't grasp that response end up eating their own tails.

  • Sendmail (Score:2, Interesting)

    by spayeship ( 536521 )
    Just wandering what sendmail uses port 587 for? I haven't disabled it in the past as I assummed it was need for sendmail to work, but maybe not according to this article!
    • %cat /etc/services |grep 587
      submission 587/tcp
      submission 587/udp

      %cat /etc/defaults/rc.conf | grep sendmail_submit
      sendmail_submit_enable="YES" # Start a localhost-only MTA for mail submission
      sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"

    • Re:Sendmail (Score:4, Informative)

      by scrytch ( 9198 ) <chuck@myrealbox.com> on Tuesday September 23, 2003 @08:45AM (#7033287)
      587 is the "mail submission port", and is designed to be the port on which mail is originated, leaving port 25 for transferring mail between MTA's. This has various properties in that they can treat authentication differently (SMTP auth is required on port 587), and therefore has a number of anti-spam properties as well as some other benefits. Obviously port 25 is not going away for MSA's anytime soon, but it's a step. One big adopter of this is AOL: AOL users using AOL network services (e.g. corporate accounts) already are required to use port 587 when not using an AOL dialup, as AOL already rejects direct-to-MX on port 25 for most dynamic IP's.

      It's all spelled out in RFC2476 [faqs.org]
  • Has anyone ever done a comparative study on the pros and cons of BSD vs Linux
  • I run a small unix shell provider running on BSD, and while I was running though this how-to, I came accross a number of things not set-up for a secure system.

    Congrats to the wonderful person who wrote this document, I found it increadably useful!

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (1) Gee, I wish we hadn't backed down on 'noalias'.

Close