Security settings

R

rawmat

Hello,

As a new user of FreeBSD i would like to know, what basic security settings you implement for a desktop use case.
Thank you.
 
rawmat said:
what basic security settings you implement for a desktop use case
Click to expand...
:cool:
Code: 
security.bsd.see_other_uids="0"
security.bsd.see_other_gids="0"
security.bsd.see_jail_proc="0"
security.bsd.unprivileged_read_msgbuf="0"
security.bsd.unprivileged_proc_debug="0"
kern.randompid="1"
machdep.mitigations.flush_rsb_ctxsw="0"
machdep.mitigations.rngds.enable="0"
kern.elf64.aslr.shared_page="0"
kern.elf64.aslr.stack="0"
kern.elf64.aslr.pie_enable="0"
kern.elf64.aslr.enable="0"
 
Maybe you'll find this interesting.
Note that, as far as I know, HardenedBSD is the "security centric" distribution based on FreeBSD with some additional security features, and (not all but) many of functionalities that FreeBSD looks lacking may be something FreeBSD intentionally disabling by default for backward compatibility reason (even though activatable via configurations).
 
And what I "currently" have (including comments) in my /boot/loader.conf are:
Code: 
## Enable Kernel Page Table Isolation (KPTI) for amd64, workaround
## for the 'meltdown' vulnerability.
vm.pmap.pti=1

## Indirect Branch Restricted Speculation
## Set 0 to enable.
hw.ibrs_disable=0

## Select 0 to 3 for TAA mitigation mode.
##  0: No mitigation enabled.
##  1: Disable TSX via MSR.
##  2: Use VERW mitigation.
##  3: Automatically select the mitigation.
##
## Below are not selectable (report only)
##  4: Mitigation present in microcode.
##  5: TSX is not present.
machdep.mitigations.taa.enable=3

Note that configs in /etc/sysctl.conf or in others are not shown, and I'm the only user of the computer (no others use it).
 
Code: 
# --- [ 1. SECURITY & JAILS ] ---

## Enable Kernel Page Table Isolation (KPTI) for amd64, workaround
## for the 'meltdown' vulnerability.
## vm.pmap.pti=1

#machdep.mitigations.flush_rsb_ctxsw="0"
#machdep.mitigations.rngds.enable="0"

## Indirect Branch Restricted Speculation
## Set 0 to enable.
hw.ibrs_disable=0

## Select 0 to 3 for TAA mitigation mode.
##  0: No mitigation enabled.
##  1: Disable TSX via MSR.
##  2: Use VERW mitigation.
##  3: Automatically select the mitigation.
##
## Below are not selectable (report only)
##  4: Mitigation present in microcode.
##  5: TSX is not present.
machdep.mitigations.taa.enable=3

kern.elf64.aslr.shared_page="1"
kern.elf64.aslr.stack="1"
kern.elf64.aslr.pie_enable="1"
kern.elf64.aslr.enable="1"
kern.elf32.aslr.shared_page="1"
kern.elf32.aslr.stack="1"
kern.elf32.aslr.pie_enable="1"
kern.elf32.aslr.enable="1"
kern.randompid=1

net.inet.tcp.cc.algorithm="cubic"
net.inet.tcp.pmtud_blackhole_detection=1
net.inet.ip.random_id=1
net.inet.ip.forwarding=0
net.inet.ip.maxfragpackets=0
net.inet.ip.maxfragsperpacket=0
net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1
net.inet6.ip6.temppltime=7200
net.inet6.ip6.tempvltime=14400
 
You must log in or register to reply here.
Back
Top