3 ms·

Things to Do After Installing FreeBSD

35 points by nixcraft 4y ago

phaedryx 4y ago
Interesting. I wish there were some more explanation about why you would make these changes.
- nisa 4y ago
  it's pretty much standard sysadmin things - not the author but try to explain each point in a little bit more detail anyway: 1. .hushlogin - I guess just personal preference - if you log in often it's nice to have 2. patches - update the box - same as apt-get update && apt-get upgrade on linux. doing this on fresh install is always a good idea. 3. atime=off - atime = access time is another metadata write on read and it's often not required and therefore disabled. There are some applications that depend of atime but it's a common performance improvement because you don't want to have writes when reading something - even if it's just metadata. 4. a list of tools the author uses. 5. make the shell nicer, also subjective 6. same as setting up sudo in linux but doas is more modern. You don't want to work as root all the time to reduce fatal errors and for security. 7. there are some theoretic attacks on dsa/ecdsa algorithms and I guess that's why these are disabled. Probably a good idea but there are millions of hosts with dsa/ecdsa ssh keys and nothing has happenend as far as I know. 8. default deny firewall rule that only allows ssh is always a good idea on a host that is on the internet. Automatic bots exploit anything pretty fast and quite a lot of software is reachable via internet by default without any security measures. 9. metrics - monitoring is always a good idea it's much easier to know what's going on and you can analyse / pinpoint problems much easier using some graphs. i.e. when did the network-traffic/cpu exploded - when did the disk fill up? node-exporter is pretty much the weapon of choice nowadays for that. Additional collectors for time (ntp) and disk stats are useful i.e. to alert if ntp doesn't work and to get some idea about device-utilisation. 10. bastille looks a tool for container deployments? https://bastillebsd.org/ https://bastillebsd.org/ b1. microcode has some relavance to security/cpu-bugs always a good idea for servers. b2. correct time is super important. Lot's of stuff will break in subtle ways if the time is off - i.e. SAML/Kerberos etc.pp b3. if your ssd/hdd is dying you will get an email if configured correctly.
heywoodlh 4y ago
I've never used doas, I have only used sudo and I'm just curious if anyone could explain the differences and maybe why one would use doas over sudo? Or sudo over doas? I've just never really thought about using anything besides sudo until now. :)
- vjnmbmn 4y ago
  doas is the openbsd people going "sudo is too complex and is therefore insecure". it has a way simpler config and way smaller source. it also may or may not be fully functional on linux at any given time as it likes to use openbsd kernel apis. for instance on linux by default you must supply a password every time you invoke doas, unlike sudo which provides a temporary session for the tty you authenticate against. doas supports such a session on openbsd, but relies on kernel timers, so by default that functionality is disabled in linux.
  - heywoodlh 4y ago
    Ah, interesting! Very good to know, thank you for the detailed and concise explanation.
- nixcraft 4y ago
  Sudo project means more source code == more bugs. doas is from OpenBSD, less and clean code == less bugs. At least, that is how I see it. I wrote last C code 15+ years back so you might as well ignore my comment ;)
  - heywoodlh 4y ago
    It seems to me like based on this information doas would be simpler and more secure. Another comment brought up that doas is available on Linux but doesn't function as well because kernel timers are disabled. This made me wonder: is doas not as popular as sudo because sudo functions the same across Unix-like platforms where doas doesn't? I wonder this because doas seems like it is superior but I rarely see how-to documentation (on Linux, at least) that uses anything aside from sudo (or just su) for privilege escalation.

35 points by nixcraft 4y ago

phaedryx 4y ago

Interesting. I wish there were some more explanation about why you would make these changes.

nisa 4y ago
it's pretty much standard sysadmin things - not the author but try to explain each point in a little bit more detail anyway: 1. .hushlogin - I guess just personal preference - if you log in often it's nice to have 2. patches - update the box - same as apt-get update && apt-get upgrade on linux. doing this on fresh install is always a good idea. 3. atime=off - atime = access time is another metadata write on read and it's often not required and therefore disabled. There are some applications that depend of atime but it's a common performance improvement because you don't want to have writes when reading something - even if it's just metadata. 4. a list of tools the author uses. 5. make the shell nicer, also subjective 6. same as setting up sudo in linux but doas is more modern. You don't want to work as root all the time to reduce fatal errors and for security. 7. there are some theoretic attacks on dsa/ecdsa algorithms and I guess that's why these are disabled. Probably a good idea but there are millions of hosts with dsa/ecdsa ssh keys and nothing has happenend as far as I know. 8. default deny firewall rule that only allows ssh is always a good idea on a host that is on the internet. Automatic bots exploit anything pretty fast and quite a lot of software is reachable via internet by default without any security measures. 9. metrics - monitoring is always a good idea it's much easier to know what's going on and you can analyse / pinpoint problems much easier using some graphs. i.e. when did the network-traffic/cpu exploded - when did the disk fill up? node-exporter is pretty much the weapon of choice nowadays for that. Additional collectors for time (ntp) and disk stats are useful i.e. to alert if ntp doesn't work and to get some idea about device-utilisation. 10. bastille looks a tool for container deployments? https://bastillebsd.org/ https://bastillebsd.org/ b1. microcode has some relavance to security/cpu-bugs always a good idea for servers. b2. correct time is super important. Lot's of stuff will break in subtle ways if the time is off - i.e. SAML/Kerberos etc.pp b3. if your ssd/hdd is dying you will get an email if configured correctly.

heywoodlh 4y ago

I've never used doas, I have only used sudo and I'm just curious if anyone could explain the differences and maybe why one would use doas over sudo? Or sudo over doas? I've just never really thought about using anything besides sudo until now. :)

vjnmbmn 4y ago
doas is the openbsd people going "sudo is too complex and is therefore insecure". it has a way simpler config and way smaller source. it also may or may not be fully functional on linux at any given time as it likes to use openbsd kernel apis. for instance on linux by default you must supply a password every time you invoke doas, unlike sudo which provides a temporary session for the tty you authenticate against. doas supports such a session on openbsd, but relies on kernel timers, so by default that functionality is disabled in linux.
- heywoodlh 4y ago
  Ah, interesting! Very good to know, thank you for the detailed and concise explanation.
nixcraft 4y ago
Sudo project means more source code == more bugs. doas is from OpenBSD, less and clean code == less bugs. At least, that is how I see it. I wrote last C code 15+ years back so you might as well ignore my comment ;)
- heywoodlh 4y ago
  It seems to me like based on this information doas would be simpler and more secure. Another comment brought up that doas is available on Linux but doesn't function as well because kernel timers are disabled. This made me wonder: is doas not as popular as sudo because sudo functions the same across Unix-like platforms where doas doesn't? I wonder this because doas seems like it is superior but I rarely see how-to documentation (on Linux, at least) that uses anything aside from sudo (or just su) for privilege escalation.