Date: Mon, 27 Oct 2014 22:54:14 +0100 From: Roland Smith <rsmith@xs4all.nl> To: Phil <phil@philseymour.net> Cc: freebsd-questions@freebsd.org Subject: Re: Brand New User question Message-ID: <20141027215414.GB53021@slackbox.erewhon.home> In-Reply-To: <A62554D6-A60B-4974-879A-638DAF67B14C@philseymour.net> References: <A62554D6-A60B-4974-879A-638DAF67B14C@philseymour.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--FkmkrVfFsRoUs1wW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 27, 2014 at 03:25:18PM -0500, Phil wrote: > Hi folks, > I'm just starting out with FreeBSD and very new to this environment. > Could someone please point me in the direction of where I would find a > "should- do" or "must-do" list after installing FreeBSD 10.0 for the > first time. The key points would be security (the box is connected to the > net) Read security(7). Unless you're logging into the console, set up ssh keys to log in to the machine. Do not allow root logins over ssh, and mark all consoles as insecu= re in /etc/ttys. Set up a simple firewall at this point that denies incoming packets unless they are related to earlier packets you sent yourself. A more elaborate set= up can come later. Install whatever ports(7) that you need for convenience; vim, rsync, git (to name a few). In my opinion a really important thing is set to up a subdirectory in your home-directory where you keep all relevant configuration files *under revis= ion control*. Restrict access to that directory to yourself only. Personally I like to use git for revision control. But it doesn't really matter what sys= tem you use (for text-based config files even RCS would be OK) as long as you u= se *something*. This directory should include an installation script or Makefi= le to install the config files in /etc, /usr/local/etc or whereever they need = to go. This is a great way to keep on top of changes and prevent oh-shit momen= ts. Start by importing en commiting every file that you need to change from /et= c, /usr/local/etc. Edit and test one config file at a time if possible. At this time you can start installing and enabling the services that your machine needs to run. Some services can run in a jail. Using that might be worthwhile, especially for web servers and PHP. Check if you can live with a kern.securelevel > 0. (This won't work if you want to run X11.) > and where / how can I get the latest updates. That depends. You could use freebsd-update(8) for binary updates or track t= he source tree using svnlite. > Also, is it fair to > assume that during the installation process, the boot drive was configured > as ZFS? I saw no reference to that during the O/S load. Only if you chose it in the partitioning screen in the installer on 10.x and later. Hope this helps. Roland --=20 R.F.Smith http://rsmith.home.xs4all.nl/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 5753 3324 1661 B0FE 8D93 FCED 40F6 D5DC A38A 33E0 (keyID: A38A33E0) --FkmkrVfFsRoUs1wW Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJUTr8FAAoJEED21dyjijPgICUP/00V7SuEKBpTsd6OKzKE9Eff x5CelgEF+mpsKIj3UK3BWZoCE+H11jG0Kld9pWAdF19r6C2zmgMb51jKoRWFfH8Z RA9L/HJJmGMp5CZEbuaNA7kXDH3Xz36RFNuyx7Rio9YSjxyWDmMB7lT2/ukm0nj3 jclu7wEl0xXTRi8V1Loj4mXGINlplUCFOd8bE4k41Hyrwdgh2W6RBx0AvYlFX4/N GcsMYBFmi+A6Es9tjHVJbJ8ceTyU1QaiqQWJgb7IjIFSXwMRoIjj90CTI4TeAmum 4HGjZT+m5m4V84mOeFw3ab1j1VM55hEoxmmPvTHWLgG/cC2D19+nXOzw0abtYGs3 3PGnVUqr0ogLPbRG05ljwnu5e/qVvb/ms2th8oVupYdYC6KuP+tn4Bpk88qSxRQF 18gUJ/H5F0MM9baAb5fnCxjCn51DAkYxcHUusPOMEeB8Mm+WPhJ1Deq/XaqJbgQe +w8aOXHHxk1nW9LKA4+qmZhqvMFb9DOxOdHKClQtywFKFGW1drcf9BrfgV71Vb6h ZESUO4hNj/EdrIYJ2q5EnX2jk9qN9S9tG7wVCo1cQ/Gyk/+bKT97+pYByyYIHb0l EC9FBuju7p5wTO57cx05LeC33bC9KTA8MkU2xNzhBxj/g6+HVo3VotYHC3h11yd9 CwJ2QBmAiOmtctEB4sXp =5GWV -----END PGP SIGNATURE----- --FkmkrVfFsRoUs1wW--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20141027215414.GB53021>