Security settings

[rawmat]

Hello,

As a new user of FreeBSD i would like to know, what basic security settings you implement for a desktop use case.
Thank you.

 

[dark.initr0]

very useful is

man security

 

[Espionage724]

what basic security settings you implement for a desktop use case

security.bsd.see_other_uids="0"
security.bsd.see_other_gids="0"
security.bsd.see_jail_proc="0"
security.bsd.unprivileged_read_msgbuf="0"
security.bsd.unprivileged_proc_debug="0"
kern.randompid="1"
machdep.mitigations.flush_rsb_ctxsw="0"
machdep.mitigations.rngds.enable="0"
kern.elf64.aslr.shared_page="0"
kern.elf64.aslr.stack="0"
kern.elf64.aslr.pie_enable="0"
kern.elf64.aslr.enable="0"

 

[T-Aoki]

Maybe you'll find this interesting.
Note that, as far as I know, HardenedBSD is the "security centric" distribution based on FreeBSD with some additional security features, and (not all but) many of functionalities that FreeBSD looks lacking may be something FreeBSD intentionally disabling by default for backward compatibility reason (even though activatable via configurations).

 

[T-Aoki]

And what I "currently" have (including comments) in my /boot/loader.conf are:

## Enable Kernel Page Table Isolation (KPTI) for amd64, workaround
## for the 'meltdown' vulnerability.
vm.pmap.pti=1

## Indirect Branch Restricted Speculation
## Set 0 to enable.
hw.ibrs_disable=0

## Select 0 to 3 for TAA mitigation mode.
##  0: No mitigation enabled.
##  1: Disable TSX via MSR.
##  2: Use VERW mitigation.
##  3: Automatically select the mitigation.
##
## Below are not selectable (report only)
##  4: Mitigation present in microcode.
##  5: TSX is not present.
machdep.mitigations.taa.enable=3

Note that configs in /etc/sysctl.conf or in others are not shown, and I'm the only user of the computer (no others use it).

 

[Alain De Vos]

# --- [ 1. SECURITY & JAILS ] ---

## Enable Kernel Page Table Isolation (KPTI) for amd64, workaround
## for the 'meltdown' vulnerability.
## vm.pmap.pti=1

#machdep.mitigations.flush_rsb_ctxsw="0"
#machdep.mitigations.rngds.enable="0"

## Indirect Branch Restricted Speculation
## Set 0 to enable.
hw.ibrs_disable=0

## Select 0 to 3 for TAA mitigation mode.
##  0: No mitigation enabled.
##  1: Disable TSX via MSR.
##  2: Use VERW mitigation.
##  3: Automatically select the mitigation.
##
## Below are not selectable (report only)
##  4: Mitigation present in microcode.
##  5: TSX is not present.
machdep.mitigations.taa.enable=3

kern.elf64.aslr.shared_page="1"
kern.elf64.aslr.stack="1"
kern.elf64.aslr.pie_enable="1"
kern.elf64.aslr.enable="1"
kern.elf32.aslr.shared_page="1"
kern.elf32.aslr.stack="1"
kern.elf32.aslr.pie_enable="1"
kern.elf32.aslr.enable="1"
kern.randompid=1

net.inet.tcp.cc.algorithm="cubic"
net.inet.tcp.pmtud_blackhole_detection=1
net.inet.ip.random_id=1
net.inet.ip.forwarding=0
net.inet.ip.maxfragpackets=0
net.inet.ip.maxfragsperpacket=0
net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1
net.inet6.ip6.temppltime=7200
net.inet6.ip6.tempvltime=14400

 

[fernandel]

net.inet.ip.forwarding: 0

net.inet.tcp.cc.algorithm: cubic

cubic is long time default and inet forwarding the same.

 

[Maturin]

very useful is
man security

Second. It is.
At least all you need to know where to start and much more is all in there.
A very good start on making your FreeBSD system more secure.

 

[SirDice]

what basic security settings you implement for a desktop use case.

Don't run stuff from unknown origin.