Initial Security Measures in FreeBSD

Not long ago, I was asked to write about initial security measures in FreeBSD. I dragged my feet, of course, but I’m publishing the article after all—maybe someone will find it useful.

Locking down SSH

Edit the following lines in /etc/ssh/sshd_config:

# Будет добавлено к названию версии, посмотреть можно через telnet на 2244 порт
VersionAddendum SuperPuperSSH-9.8.7
# Указываем порт который будем слушать, главное чтобы он отличался от 22-го,
# так как много тупых ботов подбирающих пароли на 22 порт
Port 2244
# Внешний адрес моей машины
ListenAddress 82.146.63.195

I also recommend disabling access for the root user. In the same sshd_config, comment out this line:

#PermitRootLogin yes

DenyHost can help protect you against SSH password brute-force attacks.

Closing ports

Now let’s start the IPFW firewall:

firewall_enable="YES"
firewall_script="/etc/fw.sh"
firewall_logging="YES"

And write the initialization script /etc/fw.sh:

#!/bin/sh
FwCMD="/sbin/ipfw"

${FwCMD} -f flush
${FwCMD} 10 add check-state
# закрываем sendmail
${FwCMD} 15 add allow tcp from me to me 25
${FwCMD} 20 add deny tcp from any to me 25
${FwCMD} 30 add deny tcp from any to me 587
# закрываем mysql
${FwCMD} 40 add deny tcp from any to me 3306
# закрываем sphinx
${FwCMD} 45 add allow tcp from me to me 3312
${FwCMD} 50 add deny tcp from any to me 3312
# закрываем apache
${FwCMD} 55 add allow tcp from me to me 88
${FwCMD} 60 add deny tcp from any to me 88
# закрываем tornado web server
${FwCMD} 75 add allow tcp from me to me 8001
${FwCMD} 80 add deny tcp from any to me 8001
# закрываем tracd
${FwCMD} 105 add allow tcp from me to me 3050
${FwCMD} 110 add deny tcp from any to me 3050
# разрешаем все остальное
${FwCMD} 1000 add allow ip from any to any

Make it executable:

chmod +x /etc/fw.sh

Next, reload rc.conf.

I use Nginx to proxy to ports 88, 8001, and 3050, so I don’t need external access to them.
At the moment, I don’t have Apache installed, and I communicate with PHP-FPM through a Unix socket, so there’s no point in closing a port.

I also recommend reading Fighting HTTP Floods with IPFW.

Disabling DNS recursion and changing the Bind version

For the Bind DNS server, change the allow-recursion and version attributes in named.conf:

// Relative to the chroot directory, if any
directory       "/etc/namedb";
pid-file        "/var/run/named/pid";
dump-file       "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
allow-recursion { localnets; localhost; };
version "SuperPuperDNS-9.8.7";

In short, DNS recursion is when a DNS server, at a user’s request, performs all the queries itself to find the required information throughout the DNS system. We don’t want to do extra work, so we disable recursion.

You can check the Bind DNS server version like this:

dig @ns1.adw0rd.ru version.bind chaos txt

Hiding the Nginx version

In the /usr/local/etc/nginx/nginx.conf configuration file, set:

server_tokens off;

Sendmail for internal use only

Let’s edit /etc/rc.conf:

sendmail_enable="NO" #"NO" - for listen only 127.0.0.1

That’s basically it. This is the bare minimum that will help protect you against minor attacks and assorted script kiddies. The main thing is to keep an eye on updates for the software you use, and everything will be fine!