Contents
1. Vim Install
Install Vim, which you are familiar with as an editor, as follows
|
1 |
# pkg install -y vim |
Edit the ".shrc" to make Vim available as the standard editor, and log in again to reflect the change.
FreeBSD14 has sh as default shell.
You can check the current SHELL with the following command
|
1 2 |
# echo $SHELL /bin/sh |
|
1 2 3 4 5 6 |
# vim ~/.shrc Add the following content alias vi='vim' Configuration Reflection # shutdown -r now |
Create a new ".vimrc" to set up the environment for using Vim, and fill in the following information
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
# vi ~/.vimrc Add the following content set nocompatible set encoding=utf-8 set nobackup set tabstop=4 set clipboard+=autoselect set number syntax on highlight Comment ctermfg=LightCyan set wrap set backspace=indent,eol,start set autoindent |
Rebooting will reflect this.
2.Use of locate database
On FreeBSD, I get the following error when using updatedb
|
1 2 3 4 |
# /usr/libexec/locate.updatedb >>> WARNING >>> Executing updatedb as root. This WILL reveal all filenames >>> on your machine to all login users, which is a security risk. |
The error message is
I am running updatedb as root user.
This would allow all logged in users to see all file names. This is a security risk.
On FreeBSD, scripts under PERIODIC are run by cron, so use the update script for the locate database that cron will run
|
1 2 3 |
# /etc/periodic/weekly/310.locate Rebuilding locate database: |
3. SSH Connection Security Measures
3.1 SSH port changed, root user login disabled
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
# vi /etc/ssh/sshd_config 1 # $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ 2 3 # This is the sshd server system-wide configuration file. See 4 # sshd_config(5) for more information. 5 6 # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin 7 8 # The strategy used for options in the default sshd_config shipped with 9 # OpenSSH is to specify options with their default value where 10 # possible, but leave them commented. Uncommented options override the 11 # default value. 12 13 # Note that some of FreeBSD's defaults differ from OpenBSD's, and 14 # FreeBSD has a few additional options. 15 16 Port 2244 ←Changed Port to 2244 17 #AddressFamily any 18 #ListenAddress 0.0.0.0 19 #ListenAddress :: 20 21 #HostKey /etc/ssh/ssh_host_rsa_key 22 #HostKey /etc/ssh/ssh_host_ecdsa_key 23 #HostKey /etc/ssh/ssh_host_ed25519_key 24 25 # Ciphers and keying 26 #RekeyLimit default none 27 28 # Logging 29 #SyslogFacility AUTH 30 #LogLevel INFO 31 32 # Authentication: 33 34 #LoginGraceTime 2m 35 PermitRootLogin no ←No login by root user 36 #StrictModes yes 37 #MaxAuthTries 6 38 #MaxSessions 10 |
Reflection of settings
|
1 2 3 4 5 6 |
# service sshd restart Performing sanity check on sshd configuration. Stopping sshd. Waiting for PIDS: 795. Performing sanity check on sshd configuration. Starting sshd. |
3.2 Use public key authentication method
① Creating public and private key pairs --- logging in as a general user to create them
If you do not specify the destination and file name, id_ed25519 and id_eed25519.pub will be created in /home/(user name)/.ssh/.
On the way, enter the password for the key.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# su - huong $ ssh-keygen -t ed25519 Generating public/private ed25519 key pair. Enter file in which to save the key (/home/huong/.ssh/id_ed25519): Enter passphrase (empty for no passphrase): [Password] Enter same passphrase again: [Password] Your identification has been saved in /home/huong/.ssh/id_ed25519 Your public key has been saved in /home/huong/.ssh/id_ed25519.pub The key fingerprint is: SHA256:xboQ1lwuaVzf2FXCOtK2tD6Pie9c2mbG1GHvODpZ3y4 huong@Lepard The key's randomart image is: +--[ED25519 256]--+ | o .. +| | + * . +.o | | o B +.o.o | | . o +. * o | | . S + +..o| | . . o o o| | . . =.+.| | o=*E +| | .oOOo+.| +----[SHA256]-----+ |
|
1 2 3 |
$ cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys $ chmod 600 ~/.ssh/authorized_keys $ chmod 700 ~/.ssh/ |
➁Save the created private key id_ed25519 to an appropriate location on windows using winSCP.
➂Edit SSH configuration file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ su - # vi /etc/ssh/sshd_config 35 PermitRootLogin no 36 #StrictModes yes 37 #MaxAuthTries 6 38 #MaxSessions 10 39 40 PubkeyAuthentication yes ←Change 41 42 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 43 # but this is overridden so installations will only check .ssh/authorized_keys 44 AuthorizedKeysFile .ssh/authorized_keys 45 46 #AuthorizedPrincipalsFile none 47 48 #AuthorizedKeysCommand none 49 #AuthorizedKeysCommandUser nobody 50 51 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts 52 #HostbasedAuthentication no 53 # Change to yes if you don't trust ~/.ssh/known_hosts for 54 # HostbasedAuthentication 55 #IgnoreUserKnownHosts no 56 # Don't read the user's ~/.rhosts and ~/.shosts files 57 #IgnoreRhosts yes 58 59 # Change to yes to enable built-in password authentication. 60 # Note that passwords may also be accepted via KbdInteractiveAuthentication. 61 PasswordAuthentication no ←Change 62 #PermitEmptyPasswords no 63 64 # Change to no to disable PAM authentication 65 KbdInteractiveAuthentication no ←Change 66 67 # Kerberos options |
|
1 |
# service sshd restart |
④Connecting with TeraTerm
User name : Login User Name
Password :Password specified in the creation of a public/private key pair
Check the "Use RSA/DSA…." checkbox. and in the "Private key file" field, specify the "id_ed25519" that you just saved in windows.
SSH connection by authentication using public key cryptography can be done in the same way as other Linux, please refer to the following
4. Firewall Settings
FreeBSD has the following firewalls
・pf
・ipfw
・ipf
In this case, we will use ipfw to configure the firewall。
4.1 Check if ipfw works
|
1 2 3 |
# ipfw list ... It is OK if the output is anything other than "Commnad not found." |
4.2 Add configuration to /etc/rc.conf to use ipfw
Better to use the sysrc command than to edit the /etc/rc.conf file with a vim editor
|
1 2 3 4 5 6 7 |
# sysrc firewall_enable="YES" ←Enabled at server startup firewall_enable: YES -> YES # sysrc firewall_logdeny="YES" ←Log output to /var/log/security on denial firewall_logdeny: NO -> YES # sysrc firewall_script="/usr/local/etc/ipfw.rules" ←Specify additional configuration scripts |
4.3 Create additional configuration script (/usr/local/etc/ipfw.rules)
|
1 |
# vi /usr/local/etc/ipfw.rules |
Additional configuration script content ----- for now open the following service ports
ftp (20,21), ssh (22), smtp (25), dns (53) , http (80), ntp(123) , https(443) pop3(110), imap(143), mail-over(587) , Modified SSH(2244)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
#! /bin/sh # IPF="ipfw -q add" ipfw -q -f flush #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any $IPF 40 deny tcp from any to any frag # statefull $IPF 50 check-state $IPF 60 allow tcp from any to any established $IPF 70 allow all from any to any out keep-state $IPF 80 allow icmp from any to any $IPF 90 allow tcp from any to any 20 in $IPF 100 allow tcp from any to any 20 out $IPF 110 allow tcp from any to any 21 in $IPF 120 allow tcp from any to any 21 out $IPF 130 allow tcp from any to any 22 in $IPF 140 allow tcp from any to any 22 out $IPF 150 allow tcp from any to any 25 in $IPF 160 allow tcp from any to any 25 out $IPF 170 allow udp from any to any 53 in $IPF 175 allow tcp from any to any 53 in $IPF 180 allow udp from any to any 53 out $IPF 185 allow tcp from any to any 53 out $IPF 190 allow tcp from any to any 80 in $IPF 200 allow tcp from any to any 80 out $IPF 210 allow tcp from any to any 110 in $IPF 220 allow tcp from any to any 110 out $IPF 230 allow tcp from any to any 123 in $IPF 240 allow tcp from any to any 123 out $IPF 250 allow tcp from any to any 143 in $IPF 260 allow tcp from any to any 143 out $IPF 270 allow tcp from any to any 443 in $IPF 280 allow tcp from any to any 443 out $IPF 290 allow tcp from any to any 587 in $IPF 300 allow tcp from any to any 587 out $IPF 310 allow tcp from any to any 2244 in $IPF 320 allow tcp from any to any 2244 out # deny and log everything $IPF 500 deny log all from any to any |
System Reboot
|
1 |
# shutdown -r now |
Show ipfw list
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
# ipfw list 00010 allow ip from any to any via lo0 00020 deny ip from any to 127.0.0.0/8 00030 deny ip from 127.0.0.0/8 to any 00040 deny tcp from any to any frag offset 00050 check-state :default 00060 allow tcp from any to any established 00070 allow ip from any to any out keep-state :default 00080 allow icmp from any to any 00090 allow tcp from any to any 20 in 00100 allow tcp from any to any 20 out 00110 allow tcp from any to any 21 in 00120 allow tcp from any to any 21 out 00130 allow tcp from any to any 22 in 00140 allow tcp from any to any 22 out 00150 allow tcp from any to any 25 in 00160 allow tcp from any to any 25 out 00170 allow udp from any to any 53 in 00175 allow tcp from any to any 53 in 00180 allow udp from any to any 53 out 00185 allow tcp from any to any 53 out 00190 allow tcp from any to any 80 in 00200 allow tcp from any to any 80 out 00210 allow tcp from any to any 110 in 00220 allow tcp from any to any 110 out 00230 allow tcp from any to any 123 in 00240 allow tcp from any to any 123 out 00250 allow tcp from any to any 143 in 00260 allow tcp from any to any 143 out 00270 allow tcp from any to any 443 in 00280 allow tcp from any to any 443 out 00290 allow tcp from any to any 587 in 00300 allow tcp from any to any 587 out 00310 allow tcp from any to any 2244 in 00320 allow tcp from any to any 2244 out 00500 deny log ip from any to any 65535 deny ip from any to any |
5. NTP Server Settings
5.1 Rewrite the referenced NTP server in /etc/ntp.conf. Add an appropriate server in Japan.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# vi /etc/ntp.conf 21 # 22 # The following pool statements will give you a random set of IPv4 and IPv6 23 # NTP servers geographically close to you. A single pool statement adds 24 # multiple servers from the pool, according to the tos minclock/maxclock 25 # targets. 26 # See http://www.pool.ntp.org/ for details. Note, pool.ntp.org encourages 27 # users with a static IP and good upstream NTP servers to add a server 28 # to the pool. See http://www.pool.ntp.org/join.html if you are interested. 29 # 30 # The option `iburst' is used for faster initial synchronization. 31 # 32 #pool 0.freebsd.pool.ntp.org iburst ←Comment 33 #pool 2.freebsd.pool.ntp.org iburst ←Comment 34 pool ntp.nict.jp iburst ←Add 35 # |
5.2 Added to /etc/rc.conf to automatically start ntp at startup
|
1 2 3 4 5 |
# vi /etc/rc.conf Add the following ntpd_enable="YES" ntpd_sync_on_start="YES" |
5.3 Correct time
If the time is too far off, the NTP daemon will stop working, so use the ntpdate command to correct the time before starting the NTP daemon.
|
1 2 3 4 5 |
# ntpdate ntp.nict.jp 10 Jun 16:44:37 ntpdate[890]: step time server 61.205.120.130 offset -32400.228641 sec # /etc/rc.d/ntpd start Starting ntpd. |
5.4 Time synchronization confirmation
|
1 2 3 4 5 6 7 8 9 10 |
# ntpq -p remote refid st t when poll reach delay offset jitter ============================================================================== ntp.nict.jp .POOL. 16 p - 64 0 0.000 +0.000 0.008 +ntp-a3.nict.go. .NICT. 1 u 15 64 1 13.593 +1.783 1.812 -ntp-b3.nict.go. .NICT. 1 u 14 64 1 13.361 +0.067 0.548 *ntp-b2.nict.go. .NICT. 1 u 13 64 1 12.705 +0.976 0.873 +ntp-a2.nict.go. .NICT. 1 u 12 64 1 14.071 +0.897 0.625 -ntp-k1.nict.jp .NICT. 1 u 11 64 1 5.940 +0.147 1.042 |
+Servers that pass the connection test and can be referenced at any time
– Servers off the reference list in clustering checks
* Servers declared to be in reference synchronization