Secure Kernel Source
(Secure Kernel Source) |
(→Secure Kernel Source) |
||
| Line 2: | Line 2: | ||
== Secure Kernel Source == | == Secure Kernel Source == | ||
| − | The following are things you can do in the kernel source to tighten up security | + | The following are things you can do in the kernel source to tighten up security. You can prefix statements with # to make it a comment to disable it or delete the statement all together. |
| − | |||
At the top the file is the following statement. | At the top the file is the following statement. | ||
| − | + | options INET6<br> | |
Ipv6 is a developmental protocol, if you are not testing this protocol on purpose, it should be disabled. | Ipv6 is a developmental protocol, if you are not testing this protocol on purpose, it should be disabled. | ||
| − | Followed by Memory disk root option. This allows a operating system to be placed into memory and run. | + | Followed by Memory disk root option. This allows a operating system to be placed into memory and run. |
| − | + | ||
| − | + | ||
| + | option MD_Root | ||
| Line 22: | Line 20: | ||
Comment these out to disable them. | Comment these out to disable them. | ||
| − | + | options NFSCLIENT <br> | |
| − | + | options NFSSERVER <br> | |
| − | + | options NFSLOCKD <br> | |
| − | + | options NFS_ROOT <br> | |
| Line 31: | Line 29: | ||
Comment out the following option because you disabled Ipv6 earlier. | Comment out the following option because you disabled Ipv6 earlier. | ||
| − | + | device faith | |
| − | + | options COMPAT_FREEBSD4<br> | |
| − | + | options COMPAT_FREEBSD5<br> | |
| − | + | options COMPAT_FREEBSD6<br> | |
| − | + | options COMPAT_FREEBSD7<br> | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | Add | + | Add the following statement. |
| − | options TCP_DROP_SYNFIN | + | options TCP_DROP_SYNFIN<br> |
| − | + | Adds support for ignoring TCP packets with SYN+FIN. This prevents nmap from identifying the TCP/IP stack. | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| + | options ICMP_BANDLIM<br> | ||
| + | Enables icmp error response bandwidth limiting. This will help protect from D.O.S. packet attacks. | ||
| − | |||
| + | options RANDOM_IP_ID<br> | ||
| + | Causes the ID field in IP packets to be randomized instead of incremented by 1 with each packet generated. This closes a minor | ||
| + | information leak which allows remote observers to determine the rate of packet generation on the machine by watching the counter. | ||
| − | options | + | options NO_LKM<br> |
| − | + | Ddisable FBSD ability to dynamically load kernel modules. | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
If you do not have a printer cabled off the parallel port of this PC then disable these options. | If you do not have a printer cabled off the parallel port of this PC then disable these options. | ||
| − | |||
| − | + | device ppc <br> | |
| − | + | device ppbus <br> | |
| − | + | device lpt <br> | |
| − | + | device plip <br> | |
| − | + | device ppi <br> | |
| Line 91: | Line 70: | ||
If you are not copying this system to other PCs with different hardware, then besides the security benefit you can also reduce the time it takes to compile the kernel by removing all unused device drivers. Review your /var/run/dmesg.boot log messages to see which devices you are really using and only keep those. Comment out all the others. Do not delete the following device; it is used by most NICs but does not show up in dmesg as used. | If you are not copying this system to other PCs with different hardware, then besides the security benefit you can also reduce the time it takes to compile the kernel by removing all unused device drivers. Review your /var/run/dmesg.boot log messages to see which devices you are really using and only keep those. Comment out all the others. Do not delete the following device; it is used by most NICs but does not show up in dmesg as used. | ||
| − | device miibus | + | device miibus |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
[[Category:Securing FreeBSD]] | [[Category:Securing FreeBSD]] | ||
[[Category:FreeBSD for Servers]] | [[Category:FreeBSD for Servers]] | ||
Latest revision as of 13:26, 6 August 2012
[edit] Secure Kernel Source
The following are things you can do in the kernel source to tighten up security. You can prefix statements with # to make it a comment to disable it or delete the statement all together.
At the top the file is the following statement.
options INET6
Ipv6 is a developmental protocol, if you are not testing this protocol on purpose, it should be disabled.
Followed by Memory disk root option. This allows a operating system to be placed into memory and run.
option MD_Root
A few lines down are the network filesystem options.
Comment these out to disable them.
options NFSCLIENT
options NFSSERVER
options NFSLOCKD
options NFS_ROOT
Comment out the following option because you disabled Ipv6 earlier.
device faith
options COMPAT_FREEBSD4
options COMPAT_FREEBSD5
options COMPAT_FREEBSD6
options COMPAT_FREEBSD7
Add the following statement.
options TCP_DROP_SYNFIN
Adds support for ignoring TCP packets with SYN+FIN. This prevents nmap from identifying the TCP/IP stack.
options ICMP_BANDLIM
Enables icmp error response bandwidth limiting. This will help protect from D.O.S. packet attacks.
options RANDOM_IP_ID
Causes the ID field in IP packets to be randomized instead of incremented by 1 with each packet generated. This closes a minor
information leak which allows remote observers to determine the rate of packet generation on the machine by watching the counter.
options NO_LKM
Ddisable FBSD ability to dynamically load kernel modules.
If you do not have a printer cabled off the parallel port of this PC then disable these options.
device ppc
device ppbus
device lpt
device plip
device ppi
If you are not copying this system to other PCs with different hardware, then besides the security benefit you can also reduce the time it takes to compile the kernel by removing all unused device drivers. Review your /var/run/dmesg.boot log messages to see which devices you are really using and only keep those. Comment out all the others. Do not delete the following device; it is used by most NICs but does not show up in dmesg as used.
device miibus
