3 ms·
I completely agree. In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into it
by drclau 5y ago
I completely agree. In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1].
I had Firefox, Thunderbird, Pidgin and a few others running in complete isolation from the base system, and from each other. I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks (more of an experiment than a necessity, to be fair).
Communication between jails was done via commonly mounted nullfs. I have also setup QoS via PF for each of them.
They were all running on the host’s Xorg, which was probably also the weakness of this setup.
It was a pretty sweet setup, but required quite a bit of effort to maintain, even tho I automated most of the stuff.
Now I use macOS, and I would like more control over what apps do what. I’m not particularly impressed with the direction of the UI (it also doesn’t bother me terribly), but I welcome the finer grained security control.
References:
[0]: https://en.wikipedia.org/wiki/FreeBSD_jail https://en.wikipedia.org/wiki/FreeBSD_jail
[1]: https://www.freebsd.org/cgi/man.cgi?query=jail&sektion=8&format=html https://www.freebsd.org/cgi/man.cgi?query=jail&sektion=8&for...
- GekkePrutser 5y agoEactly, I'm moving much more towards FreeBSD now because Apple is taking so much away from us power users. Its jails (and the ports collection) are amazing. For one thing: I always require certificate logins on SSH. On Mac I used to simply change /etc/ssh/sshd_config to this effect, but since Catalina macOS reverts this with every update. Clearly they don't want me poking around in there :( IMO if you offer SSH you should offer certificate-only access as well, either with a glitzy on/off button or with a config file change, whatever. But nope... With Apple you get a lot of security for 'free', however you give up a lot of customisation in return, even in terms of security features.
- asah 5y agodumb q: can you change the path to this file?
- GekkePrutser 5y agoNot really as sshd is compiled to look for it there. You can override it with a commandline flag but that would mean changing the launchdaemon which is protected by SIP as far as I know. But I will have a look for that to doublecheck.
- eecc 5y agooh beauty! Perhaps you could share those scripts on a github?
- drclau 5y agoThanks :). If I'll find the time, I'll have to dig them up. Or maybe I'll attempt to contribute the important parts to an established project, like ezjail [0][1], which seems to be quite competent at handling jails, but is specialized on running services. Refs: [0]: http://erdgeist.org/arts/software/ezjail/ http://erdgeist.org/arts/software/ezjail/ [1]: https://www-legacy.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html https://www-legacy.freebsd.org/doc/en_US.ISO8859-1/books/han...