7 ms·

There's a lot to unpack here. For example, there's certainly other ways to network jails and all three ways you've mentioned to maintain jails are not deprecate

There's a lot to unpack here. For example, there's certainly other ways to network jails and all three ways you've mentioned to maintain jails are not deprecated. Security modules do exist, they're different from Linux. Are you sure you're not just expecting FreeBSD-as-Linux? As for init... What can I say, I've never been anti-systemd, not even remotely, but rc.d is much nicer than sysvinit, and I find it much simpler to understand than systemd. In fact, I think rc.d is an example of how Linux could have alternatively migrated from sysvinit without pissing some people off.

acatton 5y ago
> Security modules do exist, they're different from Linux. Are you sure you're not just expecting FreeBSD-as-Linux? You're right. My original message was wrong, I edited it, while keeping the original content. What I meant is "good security module". SELinux on CentOS is "enabled by default and forget about it", unless you do something weird. MAC (= Mandatory Access Control) on FreeBSD requires much more configuration. They have some cool stuff like memory limits, but it's not as powerful as SELinux.
- zie 5y ago
  The security posture is quite different, so it's not as easy as just oh, turn on some magic module and be done. Security requires work, regardless of OS. A fair bit is included in the base system already, see capsicum for example. Also, see HardenedBSD, which is arguably better than anything Linux has built-in.
  - YATA0 5y ago
    >which is arguably better than anything Linux has built-in. No it isn't. There's a reason why government and military servers run hardened Linux with SELinux, and not any of the BSDs.
    - NexRebular 5y ago
      Any source for this statement?
      - YATA0 5y ago
        There are no DoD STIGs[0] for the BSDs, meaning they cannot run on military servers. Similarly, there are no CIS guides[1]. What would I know, only designed and implemented TS+ systems for a decade! [0] https://public.cyber.mil/stigs/downloads/ https://public.cyber.mil/stigs/downloads/ [1] https://www.cisecurity.org/ https://www.cisecurity.org/
        NexRebular 5y ago
        There are a lot of them for Windows... should I then trust that linux is as secure for government use as Microsoft systems are?
        YATA0 5y ago
        Now you're shifting the goal posts after I provided sources that the US gov does not use BSD. Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD.
        NexRebular 5y ago
        Yet I see BSD on the STIG list as well. Are there different levels of security for the list items or how does this work if Windows can be said to be more secure than BSD even if both are checkmarked on the audits?
        YATA0 5y ago
        Since you keep editing your comment: Not sure what you mean, but the custom Windows Server that the US government uses is likely more secure than BSD. >Yet I see BSD on the STIG list as well. No you don't. DISA does not provide STIGs for any of the BSDs. The US government does not use the BSDs for secure systems (TS+ etc.).

acatton 5y ago

> Security modules do exist, they're different from Linux. Are you sure you're not just expecting FreeBSD-as-Linux? You're right. My original message was wrong, I edited it, while keeping the original content. What I meant is "good security module". SELinux on CentOS is "enabled by default and forget about it", unless you do something weird. MAC (= Mandatory Access Control) on FreeBSD requires much more configuration. They have some cool stuff like memory limits, but it's not as powerful as SELinux.

zie 5y ago
The security posture is quite different, so it's not as easy as just oh, turn on some magic module and be done. Security requires work, regardless of OS. A fair bit is included in the base system already, see capsicum for example. Also, see HardenedBSD, which is arguably better than anything Linux has built-in.
- YATA0 5y ago
  >which is arguably better than anything Linux has built-in. No it isn't. There's a reason why government and military servers run hardened Linux with SELinux, and not any of the BSDs.
  - NexRebular 5y ago
    Any source for this statement?
    - YATA0 5y ago
      There are no DoD STIGs[0] for the BSDs, meaning they cannot run on military servers. Similarly, there are no CIS guides[1]. What would I know, only designed and implemented TS+ systems for a decade! [0] https://public.cyber.mil/stigs/downloads/ https://public.cyber.mil/stigs/downloads/ [1] https://www.cisecurity.org/ https://www.cisecurity.org/
      - NexRebular 5y ago
        There are a lot of them for Windows... should I then trust that linux is as secure for government use as Microsoft systems are?
        YATA0 5y ago
        Now you're shifting the goal posts after I provided sources that the US gov does not use BSD. Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD.
        NexRebular 5y ago
        Yet I see BSD on the STIG list as well. Are there different levels of security for the list items or how does this work if Windows can be said to be more secure than BSD even if both are checkmarked on the audits?
        YATA0 5y ago
        Since you keep editing your comment: Not sure what you mean, but the custom Windows Server that the US government uses is likely more secure than BSD. >Yet I see BSD on the STIG list as well. No you don't. DISA does not provide STIGs for any of the BSDs. The US government does not use the BSDs for secure systems (TS+ etc.).