章 13. 安全性

要確保一個系統的安全最好的起點便是做好帳號的稽查，確保 root 使用了一個強而有力的密碼，並這個密碼未在其他地方使用過，然後關閉任何無須登入存取權的帳號。

要防止登入存取帳號有兩種方法，第一種是鎖定帳號，以下範例會鎖定 toor 帳號：

第二種防止登入存取的方式是狀 Shell 更改為 /usr/sbin/nologin，只有超級使用者可以更改其他使用者的 Shell：

/usr/sbin/nologin shell 可以避免系統分配 Shell 給嘗試登入的使用者。

在有一些案例，需要與其他使用者共用系統管理權限，FreeBSD 有兩種方式可以處理這種情況。第一種，也是較不建議的方式，是與 wheel 群組的成員共用 root 的密碼，這種方式使用者可以在需要超級使用者的存取權時輸入 su 然後輸入 wheel 的密碼，在完成需要管理存取權的指令之後，使用應輸入 exit 離開。要加入使用者到這個群組，可編輯 /etc/group 然後加入該使用者到 wheel 項目的最後，使用者必須以逗號字元分隔並不可有空白。

第二種方式，也是較建議的方式，安裝 security/sudo 套件或 Port 來提升權限。這個軟體提供了額外的稽查、更細微的使用者控制，然後可以設定鎖定使用者只能執行特定需權限的指令。

在安裝之後，使用 visudo 來編輯 /usr/local/etc/sudoers。這個範例會建立新 webadmin 群組，並加入 trhodes 帳號到該群組，然後設定該群組可重新啟動 apache24 的存取權：

密碼是資訊科技的必要之惡，當必須使用密碼時，應要有複雜且強大的雜湊機制來加密儲存在密碼資料庫中的密碼。FreeBSD 支援 DES, MD5, SHA256, SHA512 以及 Blowfish 雜湊演算法於其 crypt() 程式庫。預設使用 SHA512，不建議改成更不安全的雜湊演算法，但可改成更安全的 Blowfish 演算法。

要知道目前用何種雜湊演算法來加密某位使用者密碼，超級使用者可以檢視在 FreeBSD 密碼資料庫中該使用者的雜湊，每個雜湊的一開始便會以符號標示其用來加密密碼所使用的雜湊機制。若使用 DES 則開始不會有任何符號，而 MD5 的符號則是 $，SHA256 及 SHA512 的符號是 $6$，Blowfish 的符號是 $2a$。在以下例子中 dru 的密碼使以預設的 SHA512 演算法加密，因為其雜湊的開始為 $6$。注意，該加密過的雜湊，不是原來的密碼，會儲存於密碼資料庫中：

雜湊機制是設定在該使用者的登入類別 (Login class)，以此為例，該使用者屬於 default 登入類別，且雜湊演算法是以下行設定在 /etc/login.conf：

要更改演算法為 Blowfish，可修改該行如下：

然後依 設定登入類別 中所描述的方式執行 cap_mkdb /etc/login.conf。注意，這個動作不會影響任何已存在的密碼雜湊，但這代表必須要求所有使用者執行 passwd 來更改其密碼才有辦法重新加密所有密碼。

針對遠端登入，應使用雙重認證 (Two-factor authentication)，舉例來說您同時要 "有某樣東西"，如：鑰匙，以及 "知道某個資訊"，如：密碼。自從 OpenSSH 是 FreeBSD 基礎系統的一部份，所有來算網路的登入應透過加密過的連線且使用以金鑰為基礎的認証來替代密碼。要了解更多資訊請參考 OpenSSH。Kerberos 的使用者可能會需要多做一些額外的更改才能在其網路上使用 OpenSSH，這些更改在 Kerberos 中會有說明。

強制在本地帳號使用高強度密碼的政策是系統安全的基礎之一。在 FreeBSD 密碼長度、密碼強度以及密碼複雜性可使用內建的可插拔認証模組 (Pluggable Authentication Modules, PAM) 來執行。

本節將示範如何設定密碼長度下限與上限以及使用 pam_passwdqc.so 來強制使用混合字元的密碼，此模組可在使用者更改其密碼時強制要求。

要設定此模組，需要先成為超級使用者，然後取消註解在 /etc/pam.d/passwd 中含有 pam_passwdqc.so 的行。然後編輯該行來配合密碼政策：

這個例子會設定新密碼所需符合的需求。min 設定可以控制密碼長度下限，它有五個值因為這個模組根據密碼的複雜度定義了五種類型。而複雜度是由必須在密碼中存在的字元類型來定義，例如：文字、數字、符號以及大小寫，這些密碼類型在 pam_passwdqc(8) 有詳細的說明。在這個例子，密碼類型的前三項為關閉的，代表不會接受只滿足這些複雜度的密碼，不論長度為何。12 設定密碼政策可接受滿足三種字元類型複雜度且至少 12 個字元的密碼，10 設定密碼政策接受滿足四種字元類型複雜度且至少 10 個字元的密碼。

similar 設定則會拒絕以使用者前一次類似的密碼。retry 設定會提供使用者三次輸入新密碼的機會。

一這個檔案儲存之後，更改密碼的使用者將會看到如下的訊息：

若輸入了一個不符何密碼政策的密碼，則會被拒絕並顯示警告，然後使用者會有機會再重試，直到超過設定的允許重試次數。

大多數密碼政策會讓密碼在多日過後過期。要在 FreeBSD 設定密碼年齡日期，可在 /etc/login.conf 中該使用者的登入類別設定 passwordtime。在 default 登入類別已有設定範例：

因此，要設定此登入類別的密碼在 90 天之後過期只需要移除註解符號 (#)，然後儲存編輯結果並執行 cap_mkdb /etc/login.conf。

要在個別使用者設定期限，可將有效日期或到期的天數與使用者名稱傳給 pw：

如這個例子，有效日期的格式為天、月以及年。要取得更多資訊可參考 pw(8)。

rootkit 指的是嘗試未經授權取得系統 root 存取權的軟體。一旦安裝之後，這個惡意軟體將可以光明正大的開啟給另一個給攻擊者進入的大門。現實上，一但系統已被 rootkit 滲透且執行了搜索動作之後，該系統就應該從頭重新安裝，因為即使非常謹真的資安或系統工程式也可能會遺漏攻擊者留下的動西。

rootkit 對管理者而言唯一有幫助的是：一但偵測到，便代表某處已經被滲透，但這類型的應用程式躲藏的非常好，本節將會示範一個可以用來偵測 rootkit 的工具，security/rkhunter。

安裝此套件或 Port 之後，系統便可使用以下指令檢查。該指令提供許多資訊且會需要手動按下 ENTER 確認：

該程序完成之後，目前狀態的訊息便會顯示在畫面上。這個訊息包含了已檢查過多少檔案、可疑的檔案、可能的 rootkit 以及其他更多資訊。在檢查的過程中，可能會產生一些有關隱藏檔案、OpenSSH 通訊協定選擇及已安裝軟體已知漏洞版本的通用的安全性警告、這些問題可以立即處理或在更詳細的分析之後再處理。

每位管理者應了解在系統上執行了那些程式以及這些程式的用途。第三方工具如 rkhunter 與 sysutils/lsof 以及原生指令如 netstat 與 ps 可以系統上大量的資訊，記錄下那一些是正常的，當有不適當的程式出現時提出疑問，然後找出答案。雖然理想要避免滲透，但也必須偵測是否已被滲透了。

檢驗系統檔案與 Binary 是很重要的，因為它可以提供系統管理者與資安團隊有關系統變更的資訊，能夠監視系統變更的軟體應用程式稱為入侵偵測系統 (Intrusion Detection System, IDS)。

FreeBSD 原生提供了基礎的 IDS 系統，雖然每天晚上會有安全性的信件會通知管理者相關的變更，但這些資訊是儲存在本地的，這讓惡意的使用者有機會能夠修改這些資訊來隱藏其對系統的變更。也因此，會建議建立一個獨立的 Binary 簽名並將這些簽名儲存在唯度、root 擁有的目錄或在可移除的 USB 磁碟或遠端 rsync 伺服器更好。

內建 mtree 工具可以對一個目錄中的內容產生一個規格檔，產生規格檔會用到一個種子碼 (Seed) 或常數，然後在檢查規格是否有更改過時會也會需要使用這個種子碼或常數。這讓檢查一個檔案或 Binary 是否被修改變成可能的一件事。由於攻擊者並不知道種子碼，要仿冒或檢查檔案的校驗碼 (Checksum) 數值是幾乎不可能的。以下例子會產生一組 SHA256 雜湊，每一個在 /bin 的系統 Binary 都會有一個，並姐會將這些值以隱藏黨儲存在 root 的家目錄，/root/.bin_chksum_mtree：

3483151339707503 代表種子碼，這個值應要記錄下來且不可給其它人看。

檢視 /root/.bin_cksum_mtree 應會產生類似以下的輸出結果：

機器的主機名稱、建立規格檔的日期與時間、以及建立此規格檔的使用者名稱皆會記錄在此報告當中，報告當中還會有在目錄中每個 Binary 的校驗碼、大小、時間以及 SHA256 編碼。

要檢驗 Binary 簽名是否有被變更過，可使用先前產生的規格檔比對目前目錄的內容，然後儲存結果到檔案。這個指令需要當初產生原規格檔所使用的種子碼：

這個動作應會產生與上次建立 /bin 規格檔時產生的校驗碼相同，若在此目錄的 Binary 沒有被變更過，那麼 /root/.bin_chksum_output 這個輸出檔將會是空的。要模擬變更，可以使用 touch 更改 /root/.bin_chksum_output 的日期然後再執行檢驗指令一次：

建議對含有 Binary 以及設定檔的目錄建立規格檔，對含有敏感資料的目錄也是。通常會為 /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /etc 及 /usr/local/etc 建立規格檔。

也有更進階的 IDS 系統，例如 security/aide。大多數情況 mtree 已可提供管理者所需的功能。將種子碼與校驗碼結果保存在惡意使用者無法存取的地方是非常重要的一件事。更多有關 mtree 的資訊可在 mtree(8) 找到。

在 FreeBSD，有許多系統功能可以使用 sysctl 調校，本節會涵蓋少數可以調校來避免阻斷服務 (Denial of Service, DoS) 攻擊的安全性功能。更多有關使用 sysctl 的資訊包含：如何暫時更改數值及如何在測試之後做永久更改可在 使用 sysctl(8) 調校 找到。

預設 FreeBSD 核心會使用安全性層級 -1 來開機，這又稱作"不安全模式"，因為不可變 (Immutable) 檔案旗標可以被關閉且可以讀取或寫入所有的裝置。除非有使用 sysctl 或在啟動 Script 設定修改該值，否則安全性層級將會在 -1。安全性層級可以在系統啟動時透過在 /etc/rc.conf 設定 kern_securelevel_enable 為 YES 以及 設定 kern_securelevel 的值為想要的安全層級來提升。請參考 security(7) 以及 init(8) 以取得更多與這些設定及可用的安全性層級相關的資訊。

net.inet.tcp.blackhole 以及 net.inet.udp.blackhole 設定可以用來丟棄在已關閉連接埠 (Port) 收到的 SYN 封包且不會回傳 RST 回應，預設的動作是會回傳 RST 來表示該連接埠已被關閉，更改預設的動作可對連接埠掃描 (用在查看在系統上執行的應用程式) 提供一定程度的保護，要這麼做可設定 net.inet.tcp.blackhole 為 2 及 net.inet.udp.blackhole 為 1。請參考 blackhole(4) 以取得更多有關這些設定的資訊。

net.inet.icmp.drop_redirect 以及 net.inet.ip.redirect 設定可以幫助避免 重新導向攻擊 (Redirect attacks)，重新導向攻擊是 DoS 的一種，會傳送大量 ICMP 類型 5 的封包，由於這些封包並不是必要的，設定 net.inet.icmp.drop_redirect 為 1 以及設定 net.inet.ip.redirect 為 0 可丟棄這些封包。

來源路由 (Source routing) 是一種偵測與存取在內部網路中不可路由位址的方法，由於不可路由位址通常是固故讓它不可路由的，因此可以關閉這個功能。要關閉這個功能可設定 net.inet.ip.sourceroute 以及 net.inet.ip.accept_sourceroute 為 0。

當一台在網路上的機器需要傳送訊息給所有在子網路上的主機時，會發送 ICMP 回應請求訊息到廣播位址。然而，外部的主機是沒有理由可以執行這個動作的。要拒絕所有來自外部的廣播請求可設定 net.inet.icmp.bmcastecho 為 0。

還有一些額外的設定在 security(7) 有說明。

第一次要初始化 OPIE，要在安全的場所執行以下指令：

-c 會設定採用假設指令在安全場所執行的 Console 模式，如在使用者掌控之中的電腦或者透過 SSH 連線到一台在使用者掌控之中的電腦。

提示出現後，輸入用來產生一次性登入金鑰的秘密密碼，應使用一個不容易被猜出來的密碼，且應與使用者登入帳號所使用的密碼不同，密碼必須介於 10 到 127 個字元長度之間，然後請記住這個密碼。

ID 行會列出登入名稱 (unfurl)、預設的疊代次數 (499) 以及預設的種子碼 (to4268)。在進行登入時，系統會記住這些參數並且顯示出來，這也代表不需要另外記錄這些資訊。最後一行會列出根據這些參數與秘密密碼所產生出來的一次性密碼，在下一次登入時便要使用這個一次性密碼。

要在不安全的系統上初始化或更改秘密密碼會需要某個可使用安全的連線的地方執行 opiekey，這可能是在某一台信任的主機上的 Shell。初始化需要設定疊代次數，100 可能是不錯的數字，種子碼可以自行指定或隨機產生，在不安全連線下要被初始化主機須使用 opiepasswd(1)：

要採用預設的種子碼，可直接按下 Return 做初始化。接著在輸入回應之前移到安全的連線然後給予相同的加密參數產生密碼：

切換回不安全的連線，然後複製產生的一次性密碼貼上。

在初始化 OPIE 之後進行登入會顯示如下的提示訊息：

OPIE 的提示提供了一個很有用的功能，若在密碼提示時按下 Return，便會開啟回應功能並顯示輸入的內容，這個功能在嘗試手工輸入列印出來的密碼時很有用。

此時，要產生一次性密碼來回應登入時的提示，這必須在受信任且可安全執行 opiekey(1) 的系統上完成。這個指令有提供 Windows™, Mac OS™ 與 FreeBSD 版本，使用時需要疊代次數與種子碼做為在指令列的參數，剪下在要登入主機在登入時所提示的訊息。

在信任的系統上執行：

在產生一次性密碼後，回到登入畫面繼續登入。

有時會無法存取信任的主機或沒有安全的連線，在這種情況下，可以使用 opiekey(1) 來預先產生多個一次性密碼，例如：

-n 5 會請求產生連續五個金鑰，而 30 則是指定最後一個疊代的編號。注意這些列印出的結果的順序與使用的順序相反。十足的偏執狂可能會想要用手寫下結果，否則就列印出清單。每一行會同時顯示疊代次數及一次性密碼，在密碼使用過後便可劃掉。

OPIE 可以根據登入階段的 IP 位置限制使用 UNIX™ 密碼，相關的檔案為 /etc/opieaccess，這個檔案預設便存在。請參考 opieaccess(5) 來取得更多有關此檔案的資訊以及當使用時要考量的安全性問題。

這裡有一個範本 opieaccess：

這一行允許來源 IP 位址 (容易受到詐騙的位址) 符合指定值與遮罩的使用者在任何時間可使用 UNIX™ 密碼登入。

若在 opieaccess 中沒有符合的規則，預設會拒絕非 OPIE 的登入。

To enable TCP Wrapper in FreeBSD, add the following lines to /etc/rc.conf:

Then, properly configure /etc/hosts.allow.

In the simplest configuration, daemon connection policies are set to either permit or block, depending on the options in /etc/hosts.allow. The default configuration in FreeBSD is to allow all connections to the daemons started with inetd.

Basic configuration usually takes the form of daemon : address : action, where daemon is the daemon which inetd started, address is a valid hostname, IP address, or an IPv6 address enclosed in brackets ([ ]), and action is either allow or deny. TCP Wrapper uses a first rule match semantic, meaning that the configuration file is scanned from the beginning for a matching rule. When a match is found, the rule is applied and the search process stops.

For example, to allow POP3 connections via the mail/qpopper daemon, the following lines should be appended to hosts.allow:

Whenever this file is edited, restart inetd:

TCP Wrapper provides advanced options to allow more control over the way connections are handled. In some cases, it may be appropriate to return a comment to certain hosts or daemon connections. In other cases, a log entry should be recorded or an email sent to the administrator. Other situations may require the use of a service for local connections only. This is all possible through the use of configuration options known as wildcards, expansion characters, and external command execution.

Suppose that a situation occurs where a connection should be denied yet a reason should be sent to the host who attempted to establish that connection. That action is possible with twist. When a connection attempt is made, twist executes a shell command or script. An example exists in hosts.allow:

In this example, the message "You are not allowed to use daemon name from hostname." will be returned for any daemon not configured in hosts.allow. This is useful for sending a reply back to the connection initiator right after the established connection is dropped. Any message returned must be wrapped in quote (") characters.

Another possibility is to use spawn. Like twist, spawn implicitly denies the connection and may be used to run external shell commands or scripts. Unlike twist, spawn will not send a reply back to the host who established the connection. For example, consider the following configuration:

This will deny all connection attempts from *.example.com and log the hostname, IP address, and the daemon to which access was attempted to /var/log/connections.log. This example uses the substitution characters %a and %h. Refer to hosts_access(5) for the complete list.

To match every instance of a daemon, domain, or IP address, use ALL. Another wildcard is PARANOID which may be used to match any host which provides an IP address that may be forged because the IP address differs from its resolved hostname. In this example, all connection requests to Sendmail which have an IP address that varies from its hostname will be denied:

To learn more about wildcards and their associated functionality, refer to hosts_access(5).

The Key Distribution Center (KDC) is the centralized authentication service that Kerberos provides, the "trusted third party" of the system. It is the computer that issues Kerberos tickets, which are used for clients to authenticate to servers. Because the KDC is considered trusted by all other computers in the Kerberos realm, it has heightened security concerns. Direct access to the KDC should be limited.

While running a KDC requires few computing resources, a dedicated machine acting only as a KDC is recommended for security reasons.

To begin setting up a KDC, add these lines to /etc/rc.conf:

Next, edit /etc/krb5.conf as follows:

In this example, the KDC will use the fully-qualified hostname kerberos.example.org. The hostname of the KDC must be resolvable in the DNS.

Kerberos can also use the DNS to locate KDCs, instead of a [realms] section in /etc/krb5.conf. For large organizations that have their own DNS servers, the above example could be trimmed to:

With the following lines being included in the example.org zone file:

Next, create the Kerberos database which contains the keys of all principals (users and hosts) encrypted with a master password. It is not required to remember this password as it will be stored in /var/heimdal/m-key; it would be reasonable to use a 45-character random password for this purpose. To create the master key, run kstash and enter a password:

Once the master key has been created, the database should be initialized. The Kerberos administrative tool kadmin(8) can be used on the KDC in a mode that operates directly on the database, without using the kadmind(8) network service, as kadmin -l. This resolves the chicken-and-egg problem of trying to connect to the database before it is created. At the kadmin prompt, use init to create the realm’s initial database:

Lastly, while still in kadmin, create the first principal using add. Stick to the default options for the principal for now, as these can be changed later with modify. Type ? at the prompt to see the available options.

Next, start the KDC services by running service kdc start and service kadmind start. While there will not be any kerberized daemons running at this point, it is possible to confirm that the KDC is functioning by obtaining a ticket for the principal that was just created:

Confirm that a ticket was successfully obtained using klist:

The temporary ticket can be destroyed when the test is finished:

The first step in configuring a server to use Kerberos authentication is to ensure that it has the correct configuration in /etc/krb5.conf. The version from the KDC can be used as-is, or it can be regenerated on the new system.

Next, create /etc/krb5.keytab on the server. This is the main part of "Kerberizing" a service — it corresponds to generating a secret shared between the service and the KDC. The secret is a cryptographic key, stored in a "keytab". The keytab contains the server’s host key, which allows it and the KDC to verify each others' identity. It must be transmitted to the server in a secure fashion, as the security of the server can be broken if the key is made public. Typically, the keytab is generated on an administrator’s trusted machine using kadmin, then securely transferred to the server, e.g., with scp(1); it can also be created directly on the server if that is consistent with the desired security policy. It is very important that the keytab is transmitted to the server in a secure fashion: if the key is known by some other party, that party can impersonate any user to the server! Using kadmin on the server directly is convenient, because the entry for the host principal in the KDC database is also created using kadmin.

Of course, kadmin is a kerberized service; a Kerberos ticket is needed to authenticate to the network service, but to ensure that the user running kadmin is actually present (and their session has not been hijacked), kadmin will prompt for the password to get a fresh ticket. The principal authenticating to the kadmin service must be permitted to use the kadmin interface, as specified in kadmind.acl. See the section titled "Remote administration" in info heimdal for details on designing access control lists. Instead of enabling remote kadmin access, the administrator could securely connect to the KDC via the local console or ssh(1), and perform administration locally using kadmin -l.

After installing /etc/krb5.conf, use add --random-key in kadmin. This adds the server’s host principal to the database, but does not extract a copy of the host principal key to a keytab. To generate the keytab, use ext to extract the server’s host principal key to its own keytab:

Note that ext_keytab stores the extracted key in /etc/krb5.keytab by default. This is good when being run on the server being kerberized, but the --keytab path/to/file argument should be used when the keytab is being extracted elsewhere:

The keytab can then be securely copied to the server using scp(1) or a removable media. Be sure to specify a non-default keytab name to avoid inserting unneeded keys into the system’s keytab.

At this point, the server can read encrypted messages from the KDC using its shared key, stored in krb5.keytab. It is now ready for the Kerberos-using services to be enabled. One of the most common such services is sshd(8), which supports Kerberos via the GSS-API. In /etc/ssh/sshd_config, add the line:

做完了這個變更之後，必須重新啟動 sshd(8) 來使新的設定值生效：service sshd restart。

As it was for the server, the client requires configuration in /etc/krb5.conf. Copy the file in place (securely) or re-enter it as needed.

Test the client by using kinit, klist, and kdestroy from the client to obtain, show, and then delete a ticket for an existing principal. Kerberos applications should also be able to connect to Kerberos enabled servers. If that does not work but obtaining a ticket does, the problem is likely with the server and not with the client or the KDC. In the case of kerberized ssh(1), GSS-API is disabled by default, so test using ssh -o GSSAPIAuthentication=yes hostname.

When testing a Kerberized application, try using a packet sniffer such as tcpdump to confirm that no sensitive information is sent in the clear.

Various Kerberos client applications are available. With the advent of a bridge so that applications using SASL for authentication can use GSS-API mechanisms as well, large classes of client applications can use Kerberos for authentication, from Jabber clients to IMAP clients.

Users within a realm typically have their Kerberos principal mapped to a local user account. Occasionally, one needs to grant access to a local user account to someone who does not have a matching Kerberos principal. For example, tillman@EXAMPLE.ORG may need access to the local user account webdevelopers. Other principals may also need access to that local account.

The .k5login and .k5users files, placed in a user’s home directory, can be used to solve this problem. For example, if the following .k5login is placed in the home directory of webdevelopers, both principals listed will have access to that account without requiring a shared password:

Refer to ksu(1) for more information about .k5users.

The major difference between the MIT and Heimdal implementations is that kadmin has a different, but equivalent, set of commands and uses a different protocol. If the KDC is MIT, the Heimdal version of kadmin cannot be used to administer the KDC remotely, and vice versa.

Client applications may also use slightly different command line options to accomplish the same tasks. Following the instructions at http://web.mit.edu/Kerberos/www/ is recommended. Be careful of path issues: the MIT port installs into /usr/local/ by default, and the FreeBSD system applications run instead of the MIT versions if PATH lists the system directories first.

When using MIT Kerberos as a KDC on FreeBSD, the following edits should also be made to rc.conf:

When configuring and troubleshooting Kerberos, keep the following points in mind:

Since Kerberos is an all or nothing approach, every service enabled on the network must either be modified to work with Kerberos or be otherwise secured against network attacks. This is to prevent user credentials from being stolen and re-used. An example is when Kerberos is enabled on all remote shells but the non-Kerberized POP3 mail server sends passwords in plain text.

The KDC is a single point of failure. By design, the KDC must be as secure as its master password database. The KDC should have absolutely no other services running on it and should be physically secure. The danger is high because Kerberos stores all passwords encrypted with the same master key which is stored as a file on the KDC.

A compromised master key is not quite as bad as one might fear. The master key is only used to encrypt the Kerberos database and as a seed for the random number generator. As long as access to the KDC is secure, an attacker cannot do much with the master key.

If the KDC is unavailable, network services are unusable as authentication cannot be performed. This can be alleviated with a single master KDC and one or more slaves, and with careful implementation of secondary or fall-back authentication using PAM.

Kerberos allows users, hosts and services to authenticate between themselves. It does not have a mechanism to authenticate the KDC to the users, hosts, or services. This means that a trojanned kinit could record all user names and passwords. File system integrity checking tools like security/tripwire can alleviate this.

To generate a certificate that will be signed by an external CA, issue the following command and input the information requested at the prompts. This input information will be written to the certificate. At the Common Name prompt, input the fully qualified name for the system that will use the certificate. If this name does not match the server, the application verifying the certificate will issue a warning to the user, rendering the verification provided by the certificate as useless.

Other options, such as the expire time and alternate encryption algorithms, are available when creating a certificate. A complete list of options is described in openssl(1).

This command will create two files in the current directory. The certificate request, req.pem, can be sent to a CA who will validate the entered credentials, sign the request, and return the signed certificate. The second file, cert.key, is the private key for the certificate and should be stored in a secure location. If this falls in the hands of others, it can be used to impersonate the user or the server.

Alternately, if a signature from a CA is not required, a self-signed certificate can be created. First, generate the RSA key:

Use this key to create a self-signed certificate. Follow the usual prompts for creating a certificate:

This will create two new files in the current directory: a private key file cert.key, and the certificate itself, cert.crt. These should be placed in a directory, preferably under /etc/ssl/, which is readable only by root. Permissions of 0700 are appropriate for these files and can be set using chmod.

One use for a certificate is to encrypt connections to the Sendmail mail server in order to prevent the use of clear text authentication.

In FreeBSD 10.0-RELEASE and above, it is possible to create a self-signed certificate for Sendmail automatically. To enable this, add the following lines to /etc/rc.conf:

This will automatically create a self-signed certificate, /etc/mail/certs/host.cert, a signing key, /etc/mail/certs/host.key, and a CA certificate, /etc/mail/certs/cacert.pem. The certificate will use the Common Name specified in sendmail_cert_cn. After saving the edits, restart Sendmail:

If all went well, there will be no error messages in /var/log/maillog. For a simple test, connect to the mail server’s listening port using telnet:

If the STARTTLS line appears in the output, everything is working correctly.

To begin, security/ipsec-tools must be installed from the Ports Collection. This software provides a number of applications which support the configuration.

The next requirement is to create two gif(4) pseudo-devices which will be used to tunnel packets and allow both networks to communicate properly. As root, run the following commands, replacing internal and external with the real IP addresses of the internal and external interfaces of the two gateways:

Verify the setup on each gateway, using ifconfig. Here is the output from Gateway 1:

Here is the output from Gateway 2:

Once complete, both internal IP addresses should be reachable using ping(8):

As expected, both sides have the ability to send and receive ICMP packets from the privately configured addresses. Next, both gateways must be told how to route packets in order to correctly send traffic from either network. The following commands will achieve this goal:

At this point, internal machines should be reachable from each gateway as well as from machines behind the gateways. Again, use ping(8) to confirm:

Setting up the tunnels is the easy part. Configuring a secure link is a more in depth process. The following configuration uses pre-shared (PSK) RSA keys. Other than the IP addresses, the /usr/local/etc/racoon/racoon.conf on both gateways will be identical and look similar to:

For descriptions of each available option, refer to the manual page for racoon.conf.

The Security Policy Database (SPD) needs to be configured so that FreeBSD and racoon are able to encrypt and decrypt network traffic between the hosts.

This can be achieved with a shell script, similar to the following, on the corporate gateway. This file will be used during system initialization and should be saved as /usr/local/etc/racoon/setkey.conf.

Once in place, racoon may be started on both gateways using the following command:

The output should be similar to the following:

To ensure the tunnel is working properly, switch to another console and use tcpdump(1) to view network traffic using the following command. Replace em0 with the network interface card as required:

Data similar to the following should appear on the console. If not, there is an issue and debugging the returned data will be required.

At this point, both networks should be available and seem to be part of the same network. Most likely both networks are protected by a firewall. To allow traffic to flow between them, rules need to be added to pass packets. For the ipfw(8) firewall, add the following lines to the firewall configuration file:

For users of pf(4) or ipf(8), the following rules should do the trick:

Finally, to allow the machine to start support for the VPN during system initialization, add the following lines to /etc/rc.conf:

要登入一台 SSH 伺服器，可使用 ssh 然後指定在伺服器上存在的使用者名稱與 IP 位址或伺服器的主機名稱。若這是第一次連線到指定的伺服器，會提示該使用者伺服器的指紋做第一次檢驗：

SSH 會在客戶端連線時利用金鑰指紋 (Key fingerprint) 系統來驗證伺服器的真偽，當使用者在第一次連線時輸入 yes 接受了這個金鑰指紋，便會將該金鑰的複本儲存到使用者家目錄的 .ssh/known_hosts，未來嘗試登入時便會以這個存好的金鑰來驗證，若伺服器的金鑰與儲存的金鑰不同將會顯示警告訊息。若出現這個警告時，使用者應在繼續連線之前檢查金鑰變動的原因。

最近版本的 OpenSSH 預設只會接受 SSHv2 的連線。客戶端預設會盡可能使用版本 2 的通訊協定，若伺服器不支援版本 2 的通訊協定便會向下相容版本 1 的協定。要強制 ssh 只能使用指定的通訊協定，可使用 -1 或 -2，其他的選項在 ssh(1) 中有說明。

使用 scp(1) 可從遠端主機安全的複製一個檔案，以下範例會複製在遠端主機的 COPYRIGHT 到本地主機的目前目錄：

由於這個主機的指紋已驗證過，在提示用者輸入密碼之前伺服器的金鑰已自動檢查。

傳給 scp 的參數與傳給 cp 的參數相似。第一個參數是要複製的檔案，第二個參數是目地，由於檔案是透過網路取得，檔案參數需要使用 user@host:<path_to_remote_file> 格式。注意，在 scp 要遞迴複製目錄是使用 -r，如同 cp 使用 -R。

要開啟可互動的連線來複製檔案可使用 sftp，請參考 sftp(1) 來取得在 sftp 連線時可用的指令清單。

除了提供內建的 SSH 客戶端工具外，還可以設定 FreeBSD 系統為一個 SSH 伺服器，以接受來自其他 SSH 客戶端的連線。

要查看 sshd 是否正在運作，可使用 service(8) 指令：

若服務未執行，請加入下行到 /etc/rc.conf。

這會讓下次系統開機時啟動 OpenSSH 的 Daemon 程式 sshd。若要立即啟動：

在 FreeBSD 系統第一次啟動 sshd 時便會自動產生系統的主機金鑰且會顯示指紋在 Console 上，這個指紋可供使用者在第一次連線到伺服器時驗證用。

請參考 sshd(8) 可取得在啟動 sshd 時可用選項的清單以及更多完整有關認証、登入程序與各種設定檔的資訊。

現在，sshd 應可供所有在系統上有使用者名稱及密碼的使用者使用。

在 FreeBSD 廣泛使用 sshd 做為遠端管理基礎設施的同時，所有暴露在公有網路上的系統也會時常受到暴力攻擊 (Brute force attack) 與路過攻擊 (Drive by attack)。在本節會介紹一些可用來避免這些攻擊的參數。

使用在 OpenSSH 伺服器設定檔的 AllowUsers 關鍵字限制可以登入到 SSH 伺服器的使用者及來源是一個不錯的方式。例如要只允許來自 192.168.1.32 的 root 登入，可加入下行到 /etc/ssh/sshd_config：

要允許來自任何地方的 admin 登入，可只列出使用者名稱，不指定 IP 位址：

有多位使用者也應列在同一行，例如：

在對 /etc/ssh/sshd_config 做完變更後，執行以下指令告訴 sshd 重新載入設定檔：

此外，使用者可能被強制要透過公鑰與私鑰使用雙重認證 (Two factor authentication)。當需要時，使用者可以透過使用 ssh-keygen(1) 產生一堆金鑰然後將公鑰傳送給管理者，這個金鑰檔會如以上在客戶端章節所述的被放在 authorized_keys。要強制使用者只能使用這個金鑰，可能需要設定以下選項：

ACLs are enabled by the mount-time administrative flag, acls, which may be added to /etc/fstab. The mount-time flag can also be automatically set in a persistent manner using tunefs(8) to modify a superblock ACLs flag in the file system header. In general, it is preferred to use the superblock flag for several reasons:

File systems with ACLs enabled will show a plus (+) sign in their permission settings:

In this example, directory1, directory2, and directory3 are all taking advantage of ACLs, whereas public_html is not.

File system ACLs can be viewed using getfacl. For instance, to view the ACL settings on test:

To change the ACL settings on this file, use setfacl. To remove all of the currently defined ACLs from a file or file system, include -k. However, the preferred method is to use -b as it leaves the basic fields required for ACLs to work.

To modify the default ACL entries, use -m:

In this example, there were no pre-defined entries, as they were removed by the previous command. This command restores the default options and assigns the options listed. If a user or group is added which does not exist on the system, an Invalid argument error will be displayed.

Refer to getfacl(1) and setfacl(1) for more information about the options available for these commands.

Here is an example of a FreeBSD security advisory:

Every security advisory uses the following format:

Before using process accounting, it must be enabled using the following commands:

The accounting information is stored in files located in /var/account, which is automatically created, if necessary, the first time the accounting service starts. These files contain sensitive information, including all the commands issued by all users. Write access to the files is limited to root, and read access is limited to root and members of the wheel group. To also prevent members of wheel from reading the files, change the mode of the /var/account directory to allow access only by root.

Once enabled, accounting will begin to track information such as CPU statistics and executed commands. All accounting logs are in a non-human readable format which can be viewed using sa. If issued without any options, sa prints information relating to the number of per-user calls, the total elapsed time in minutes, total CPU and user time in minutes, and the average number of I/O operations. Refer to sa(8) for the list of available options which control the output.

To display the commands issued by users, use lastcomm. For example, this command prints out all usage of ls by trhodes on the ttyp1 terminal:

Many other useful options exist and are explained in lastcomm(1), acct(5), and sa(8).

In the traditional method, login classes and the resource limits to apply to a login class are defined in /etc/login.conf. Each user account can be assigned to a login class, where default is the default login class. Each login class has a set of login capabilities associated with it. A login capability is a name=value pair, where name is a well-known identifier and value is an arbitrary string which is processed accordingly depending on the name.

Resource limits differ from the default login capabilities in two ways. First, for every limit, there is a soft and hard limit. A soft limit may be adjusted by the user or application, but may not be set higher than the hard limit. The hard limit may be lowered by the user, but can only be raised by the superuser. Second, most resource limits apply per process to a specific user.

登入類別限制資源類型 lists the most commonly used resource limits. All of the available resource limits and capabilities are described in detail in login.conf(5).

There are a few other things to remember when setting resource limits:

For further information on resource limits and login classes and capabilities in general, refer to cap_mkdb(1), getrlimit(2), and login.conf(5).

The kern.racct.enable tunable must be set to a non-zero value. Custom kernels require specific configuration:

Once the system has rebooted into the new kernel, rctl may be used to set rules for the system.

Rule syntax is controlled through the use of a subject, subject-id, resource, and action, as seen in this example rule:

In this rule, the subject is user, the subject-id is trhodes, the resource, maxproc, is the maximum number of processes, and the action is deny, which blocks any new processes from being created. This means that the user, trhodes, will be constrained to no greater than 10 processes. Other possible actions include logging to the console, passing a notification to devd(8), or sending a sigterm to the process.

Some care must be taken when adding rules. Since this user is constrained to 10 processes, this example will prevent the user from performing other tasks after logging in and executing a screen session. Once a resource limit has been hit, an error will be printed, as in this example:

As another example, a jail can be prevented from exceeding a memory limit. This rule could be written as:

Rules will persist across reboots if they have been added to /etc/rctl.conf. The format is a rule, without the preceding command. For example, the previous rule could be added as:

To remove a rule, use rctl to remove it from the list:

A method for removing all rules is documented in rctl(8). However, if removing all rules for a single user is required, this command may be issued:

Many other resources exist which can be used to exert additional control over various subjects. See rctl(8) to learn about them.

採用 Sudo 的另一個優點是能夠開啟連線階段的記錄。使用內建立記錄機制與內含的 sudoreplay 指令，所有透過 Sudo 初始化的指令會被記錄下來供往後檢驗用。要開啟這個功能要加入預設記錄目錄的項目，在以下範例中使用了使用者變數來做目錄名稱，也還有許多其他記錄檔名稱慣例，可參考 sudoreplay 的操作手冊來取得進一步資訊。

一旦這個設定加入至 sudoers 檔案之後，所有的使用者設定項目便可加上記錄存取動作的項目，在 webteam 項目加入額外設定之後的範例如下：

從此之後，所有 webteam 修改 webservice 應用程式狀態的成員將會被記錄下來。要列出先前與目前連線階段的記錄可：

在輸出結果中要重播指定連線階段的記錄可搜尋 TSID= 項目，然後傳送給 sudoreplay 且不加其他選項便可以一般速度重播連線階段，例如：

sudoreplay 的擴充空間非常大，請參考說明文件來取得更多資訊。