7 ms·
HardenedBSD Feature Comparison with OpenBSD, FreeBSD, NetBSD
- yjftsjthsd-h 2y agoSecurity feature comparison, is should be said. Though I would guess it otherwise matches FreeBSD?
- bell-cot 2y agoPretty much yes? - > Introduction > Founded in 2014 by Oliver Pinter and Shawn Webb, HardenedBSD is a security-enhanced fork of FreeBSD. The HardenedBSD Project is implementing many exploit mitigation and security technologies on top of FreeBSD. The project started with Address Space Layout Randomization (ASLR) as an initial focal point and is now implementing further exploit mitigation techniques. > Why Fork FreeBSD? > HardenedBSD forked the FreeBSD codebase for ease of development. Prior to ...
- unit149 2y agoHand in glove, the only distro with stack zero-initialized by default. As of yet, still no SSL integration in crypto library.
- loeg 2y agoRead these claims with a pretty big asterisk. Implementation quality of HBSD features is often poor or very poor. https://www.fabiankeil.de/gehacktes/hardenedbsd/ https://www.fabiankeil.de/gehacktes/hardenedbsd/ is just one example. Specifically some of the changes made to "harden" the system are pretty dubious and introduce new bugs, possibly security relevant, that did not previously exist. No one runs or pen tests HBSD. It's even more niche than OpenBSD.
- coretx 2y agoSelf promotion / advertisement should always be read with a _big_ *. What should probably not be read with a _big_ * is their roadmap end: 2021... https://hardenedbsd.org/content/roadmap https://hardenedbsd.org/content/roadmap
- ori_b 2y agoWith small projects, websites tend to be updated infrequently. On the other hand, there seem to have been 11 commits to the main project repo today: https://groups.google.com/a/hardenedbsd.org/g/src-commits-all https://groups.google.com/a/hardenedbsd.org/g/src-commits-al...
- loeg 2y agoThese are all or mostly all just automated sync from upstream FreeBSD.
- transpute 2y agoA positive scenario for forks is when the original project incorporates downstream changes that were positive. Could FreeBSD implement some of the security features identified by HardenedBSD?
- loeg 2y agoCould implement some of the features (even if off by default), but probably not by using the HBSD diffs.
- MuffinFlavored 2y agoI can just think of so many better things to do than to write online arguing which BSD implementations of features is better.
- doublerabbit 2y agoWrite online how Linux distributions of features are better?
- t-3 2y agoIf anything, that's much more pointless. The biggest difference between linux distros is what package manager and init systems they use by default. BSDs develop and maintain their own kernels and userspace, so there are actual non-cosmetic differences between them.
- deleted 2y ago[deleted]
- BSDobelix 2y agoYour example is 9 years old (2015) when the project was less than 1 year old: https://hardenedbsd.org/content/about https://hardenedbsd.org/content/about It also sounds like the person wants to promote his own "ElectroBSD", but just in the form of a patch-sets because of "unresolved license issues" he reallyreally wants his GPL-Code in BSD: https://www.fabiankeil.de/gehacktes/electrobsd/ https://www.fabiankeil.de/gehacktes/electrobsd/
- loeg 2y agoThe date really doesn't matter, I promise. It's representative of the overall quality. And HBSD has been defunct/inactive for some of those 9 years, possibly the majority of them -- the 2nd developer left 5 years ago, for example.
- lattera 2y agoHardenedBSD has never been defunct or inactive.
- lattera 2y agoCould you point me to some of the current changes that have made the system buggy? If HardenedBSD's features do introduce bugs, they should be fixed.
- ruthmarx 2y agoThat checklist is interesting. In what sense does OpenBSD have most of the base OS sandboxed? I'm kind of skeptical of that, but wondering if I missed something. What any BSD needs to have a merit to a claim to security, in 2024, is some form of MAC. As long as there is no way to take away from having an all powerful root user (and pledge and unveil ain't it), then they have a long ways to go.
- loeg 2y ago> In what sense does OpenBSD have most of the base OS sandboxed? They're talking about pledge. https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
- ruthmarx 2y agoI thought that might be the case. So not actually sandboxing at all.
- yjftsjthsd-h 2y agoWhat does Sandboxing™ give you that pledge+unveil doesn't?
- ruthmarx 2y ago> Sandboxing™ Writing it like this is kind of funny, hoenstly, but not for the reasons you probably think. > give you that pledge+unveil doesn't? Not requiring the cooperation of developers to opt-in, for starters. You really think pledge and unveil are equivalent to sandboxing? Can you refer to any sandboxing solution or technologies that limit themselves to restricting syscalls and hiding file paths? Unveil is a lot more useful as a component in sandboxing, I'll give you that. Something like linux namespaces or even capabilities would be a hell of a lot better though.
- ori_b 2y agoMost programs require a setup phase, where they want a great deal of access to the environment to set up the resources they use, and a steady state phase, where they need very little access beyond pre-opened file descriptors. An externally imposed sandboxing feature can be useful for namespacing, but is necessarily less restrictive than pledge and unveil. For example, in steady state on OpenBSD, most programs can't even their own configs.
- brynet 2y agoIt's easy to invent a chart that only you can get a nearly perfect score on. This does nothing to explain what any of these features are, what are "Boot hardening" and "sysctl hardening"? At least OpenBSD's innovations page makes an attempt to explain new concepts and features that have been developed over the years, and people can make any comparisons for themselves. https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
- saagarjha 2y agoI mean, both of these are really just lists of mitigations. What would really be useful is why each of these has been developed, what attacks it tries to stop, why that was chosen as something worth protecting against, and what is out of scope for each of them.
- mmooss 2y ago"Please note that this page is out-of-date. For a more detailed and up-to-date guide to HardenedBSD's features, please visit our wiki." I don't see a comparison in the wiki. https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/wikis/home https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/wikis/...
- Panino 2y ago> Executable file integrity enforcement I assume but don't know for sure that this refers to Veriexec in NetBSD, and I'm not sure what in HardenedBSD. Anyone know? https://man.netbsd.org/veriexec.8 https://man.netbsd.org/veriexec.8 My understanding is that Veriexec isn't enabled by default - the manpage says only that "[s]ome kernels already enable Veriexec by default." If you have this enabled, how do you upgrade binaries? The manpage says that in strict mode 1, write access to monitored binaries is allowed but then access is denied. So I assume that after file modification, root then runs veriexecgen and veriexecctl load as mentioned in the manual to update the signatures list. So it seems that strict level 1 isn't functionally different from a read-only /usr or even just root-owned binaries. In either case, you just need root to update targeted binaries. Surely I'm missing something and would appreciate some insight. At a glance as an outsider, stricter modes appear somewhat functionally similar to "chflags schg" on BSD systems, where more work is needed to get around restrictions. In the case of schg, you have to reboot into single user mode, remove the schg flag, then modify the binary, and continue booting into multi-user mode. You could do this as a remote attacker (as in not having console access) depending on what boot files are or aren't protected with schg, but modifying all the necessary files can be a source of new problems.
- yjftsjthsd-h 2y agoI'm not familiar enough to know if this is particularly well adopted with NetBSD, but the obvious way to do it that I could see is A/B roots, where the active system can only update the inactive root. I suspect the actual most likely case is that it's meant for appliances where the running system doesn't update itself, and updates are accomplished via actions like "go physically replace the SD card with the new one".
- ruthmarx 2y ago> In either case, you just need root to update targeted binaries. My understanding is that the difference is you would need to boot with a kernel with veriexec disabled to replace binaries and regenerate hashes. Root alone isn't sufficient, and you can't disable veriexec as root in strict mode.
- udev4096 2y agoFor a hardened linux distro, take a look at kicksecure [0], which uses debian as base image [0] - https://www.kicksecure.com/ https://www.kicksecure.com/
- transpute 2y agoThe list of disclaimers does impute confidence in their claims: most of the topics.. are still in development and are not yet used by default .. Kicksecure has adopted a best-effort, but admittedly quite weak approach CFI, SafeStack, automatic stack variable init..unlikely..due to.. resourcing kernel security issues.. are rooted deep within its design upstream developers are not very focused on serious security enhancements
- beng-nl 2y agoLet’s appreciate the transparency and follow the project for progress rather than dismiss them for it.
- h4ck_th3_pl4n3t 2y agoCan somebody explain to me how anybody could verify or reproduce working address randomization and position independent executables? This is basically what muslc does, but with the kernel itself offering a memset / malloc with randomized padding, right? Also, what does ASLR brute force detection (SEGVGUARD) do? To me this sounds like malloc has a hook that maps process ids and tries to find heuristics of the allocated offsets? Anybody know where those features are documented do someone can try to bypass/exploit it?
- prmoustache 2y ago"hardening" doesn't mean anything without details. I see that word used several times in the list.
- snvzz 2y agoIt is cute that it only lists security features HardenedBSD has. While e.g. ignoring many security features openbsd has and HardenedBSD has not.
- BSDobelix 2y agoTo clarify things a bit, HardenedBSD is a bit like Linux+Grsecurity, but for FreeBSD, yes, there are differences, but overall it's like Grsecurity+. BTW: For Linux, OpenPaX is on the horizon: https://www.phoronix.com/news/Edera-OpenPaX-Announced https://www.phoronix.com/news/Edera-OpenPaX-Announced
- ruthmarx 2y agoOpenPaX looks great, but I can't find a patch anywhere, just an already patched forked kernel tree.
- deleted 2y ago[deleted]
- somepleb 2y agoGood to see Secure Boot is on the list. /s