Date: Wed, 22 Feb 2017 15:03:49 +0300 From: Slawa Olhovchenkov <slw@zxy.spb.ru> To: Bartek Rutkowski <robak@FreeBSD.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r314036 - head/usr.sbin/bsdinstall/scripts Message-ID: <20170222120349.GF15630@zxy.spb.ru> In-Reply-To: <201702210937.v1L9bY6V093836@repo.freebsd.org> References: <201702210937.v1L9bY6V093836@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Feb 21, 2017 at 09:37:34AM +0000, Bartek Rutkowski wrote: > Author: robak (ports committer) > Date: Tue Feb 21 09:37:33 2017 > New Revision: 314036 > URL: https://svnweb.freebsd.org/changeset/base/314036 > > Log: > Enable bsdinstall hardening options by default. > > As discussed previously, in order to introduce new OS hardening > defaults, we've added them to bsdinstall in 'off by default' mode. > It has been there for a while, so the next step is to change them > to 'on by defaul' mode, so that in future we could simply enable > them in base OS. Please include option "disable all" for simple disable all. > Reviewed by: brd > Approved by: adrian > Differential Revision: https://reviews.freebsd.org/D9641 > > Modified: > head/usr.sbin/bsdinstall/scripts/hardening > > Modified: head/usr.sbin/bsdinstall/scripts/hardening > ============================================================================== > --- head/usr.sbin/bsdinstall/scripts/hardening Tue Feb 21 09:33:21 2017 (r314035) > +++ head/usr.sbin/bsdinstall/scripts/hardening Tue Feb 21 09:37:33 2017 (r314036) > @@ -36,15 +36,15 @@ FEATURES=$( dialog --backtitle "FreeBSD > --title "System Hardening" --nocancel --separate-output \ > --checklist "Choose system security hardening options:" \ > 0 0 0 \ > - "0 hide_uids" "Hide processes running as other users" ${hide_uids:-off} \ > - "1 hide_gids" "Hide processes running as other groups" ${hide_gids:-off} \ > - "2 read_msgbuf" "Disable reading kernel message buffer for unprivileged users" ${read_msgbuf:-off} \ > - "3 proc_debug" "Disable process debugging facilities for unprivileged users" ${proc_debug:-off} \ > - "4 random_pid" "Randomize the PID of newly created processes" ${random_pid:-off} \ > - "5 stack_guard" "Insert stack guard page ahead of the growable segments" ${stack_guard:-off} \ > - "6 clear_tmp" "Clean the /tmp filesystem on system startup" ${clear_tmp:-off} \ > - "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \ > - "8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \ > + "0 hide_uids" "Hide processes running as other users" ${hide_uids:-on} \ > + "1 hide_gids" "Hide processes running as other groups" ${hide_gids:-on} \ > + "2 read_msgbuf" "Disable reading kernel message buffer for unprivileged users" ${read_msgbuf:-on} \ > + "3 proc_debug" "Disable process debugging facilities for unprivileged users" ${proc_debug:-on} \ > + "4 random_pid" "Randomize the PID of newly created processes" ${random_pid:-on} \ > + "5 stack_guard" "Insert stack guard page ahead of the growable segments" ${stack_guard:-on} \ > + "6 clear_tmp" "Clean the /tmp filesystem on system startup" ${clear_tmp:-on} \ > + "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-on} \ > + "8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-on} \ > 2>&1 1>&3 ) > exec 3>&- > > _______________________________________________ > svn-src-all@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/svn-src-all > To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170222120349.GF15630>