Changes in hardening

d0b2dbfa - Remove $FreeBSD$: one-line sh pattern

Wed, 16 Aug 2023 17:55:03 +0000

Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

fe06db18 - bsdinstall: remove sendmail hardening option

Thu, 01 Jun 2023 20:37:06 +0000

bsdinstall: remove sendmail hardening optionsendmail is fully disabled in 14.0 by defaultReviewed by: imp, emasteDifferential Revision: https://reviews.freebsd.org/D40367 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

cc42ef53 - bsdinstall: allow whitelabeling the scripts

Tue, 24 May 2022 15:49:06 +0000

bsdinstall: allow whitelabeling the scriptsApproved by: allanjude, asicilianoDifferential Revision: https://reviews.freebsd.org/D35197Sponsored by: Rubicon Communications, LLC ("Netgate") List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

4d1ba6fe - bsdinstall hardening: Replace dialog with bsddialog

Tue, 22 Mar 2022 23:52:22 +0000

bsdinstall hardening: Replace dialog with bsddialogbsdinstall/scripts/hardening: Replace (LGPL) dialog utility with(BSD-2-CLAUSE) dialog utility.Approved by: bapt (mentor)Differential Revision: https://reviews.freebsd.org/D34102 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

bf410c6e - Revert "bsdinstall: add knob to set ASLR sysctls"

Fri, 12 Nov 2021 19:32:57 +0000

Revert "bsdinstall: add knob to set ASLR sysctls"This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a.Because now ASLR is enabled by default for 64-bit architecturesand the purpose of the installation menu is to allow choosingadditional 'mitigation'/'hardening' options that are originallydisabled, remove the ASLR knob from bsdinstall.Discussed with: emasteObtained from: SemihalfSponsored by: Stormshield List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

020f4112 - bsdinstall: add knob to set ASLR sysctls

Fri, 29 Jan 2021 19:15:28 +0000

bsdinstall: add knob to set ASLR sysctlsReviewed by: mwSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D28418 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

fbc57e2d - bsdinstall: replace multiple ifs with case

Fri, 29 Jan 2021 19:00:29 +0000

bsdinstall: replace multiple ifs with caseReduce copy-paste and use a more typical construct.Sponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D28417 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

c3afb29b - Add an installer option to disable destructive dtrace.

Fri, 21 Sep 2018 09:27:32 +0000

Add an installer option to disable destructive dtrace.Submitted by: Jörg Pernfuß Approved by: re (kib)MFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D12474 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

f78bd12d - bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviour

Mon, 02 Oct 2017 14:19:31 +0000

bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviourEnabling the PID randomization option in bsdinstall(8)'s hardening menunow randomizes the effective value of kern.randompid on each boot.Previous behaviour:When kern.randompid was enabled via the the bsdinstall(8) hardening menu,a random value was generated and placed in the systems /etc/sysctl.conf askern.randompid=valueThis makes the value of kern.randompid static across reboots.New behaviour:When kern.randompid is enabled via the bsdinstall(8) hardening menu, theline kern.randompid=1 is placed in the systems /etc/sysctl.conf.This takes advantage of a new kernel feature and makes the value ofkern.randompid be randomized by the kernel on each reboot.Submitted by: Marie Helene Kvello-Aune Reviewed by: desMFC after: 2 weeksDifferential Revision: https://reviews.freebsd.org/D12433 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

391aafd7 - Remove stack guard option from hardening menu.

Fri, 21 Jul 2017 08:50:22 +0000

Remove stack guard option from hardening menu.Since kib's change the stack guard is now ON by default,this option in hardening menu of bsdinstall is no longer needed.Submitted by: Bartlomiej Rutkowski Reviewed by: baptApproved by: baptMFC after: 1 daySponsored by: Pixeware LTDDifferential Revision: https://reviews.freebsd.org/D11686 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

2669f7eb - usr.sbin/bsdinstall/scripts/hardening: fix options numbers

Thu, 06 Jul 2017 12:19:15 +0000

usr.sbin/bsdinstall/scripts/hardening: fix options numbersSubmitted by: Bartek Rutkowski Reviewed by: baptApproved by: baptMFC after: 1 dayDifferential Revision: https://reviews.freebsd.org/D11505 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

82ec242f - Add option to bsdinstall to disable insecure console, update stack guard option

Wed, 05 Jul 2017 13:37:27 +0000

Add option to bsdinstall to disable insecure console, update stack guard optionThis patch adds new bsdinstall option to hardening section that allows usersto change this behaviour to secure one and updates stack guard option so itwould set the value of relevant sysctl to 512 (2MB)Submitted by: Bartek RutkowskiReviewed by: adrian, bapt, emasteApproved by: bapt, emasteMFC after: 1 daySponsored by: Pixeware LTDDifferential Revision: https://reviews.freebsd.org/D9700 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

d8061eff - Add hardening menu item for security.bsd.see_jail_proc

Thu, 29 Jun 2017 16:39:55 +0000

Add hardening menu item for security.bsd.see_jail_procApproved by: allanjudeDifferential Revision: https://reviews.freebsd.org/D11283 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

2434a052 - Revert changes introduced in r314036 on demand by jhb and bapt.

Fri, 17 Mar 2017 11:45:46 +0000

Revert changes introduced in r314036 on demand by jhb and bapt.Approved by: bapt, jhb List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

4bf41040 - Enable bsdinstall hardening options by default.

Tue, 21 Feb 2017 09:37:33 +0000

Enable bsdinstall hardening options by default.As discussed previously, in order to introduce new OS hardeningdefaults, we've added them to bsdinstall in 'off by default' mode.It has been there for a while, so the next step is to change themto 'on by defaul' mode, so that in future we could simply enablethem in base OS.Reviewed by: brdApproved by: adrianDifferential Revision: https://reviews.freebsd.org/D9641 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

95525572 - Add 0-8 as shortcuts for jumping to menu items in the hardening menu.

Thu, 16 Feb 2017 19:58:02 +0000

Add 0-8 as shortcuts for jumping to menu items in the hardening menu.Submitted by: skreuzerReviewed by: allanjude, robakApproved by: allanjudeDifferential Revision: https://reviews.freebsd.org/D6826 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

1d01cb0d - Write kern.randompid to /etc/sysctl.conf

Tue, 09 Aug 2016 15:57:37 +0000

Write kern.randompid to /etc/sysctl.confPR: 211471Reported by: survo@protonmail.comReviewed by: robak@Approved by: allanjude@MFC after: 3 daysDifferential Revision: https://reviews.freebsd.org/D7440 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

72121342 - Fix non-functional bsdinstall services dialog.

Mon, 01 Aug 2016 19:49:42 +0000

Fix non-functional bsdinstall services dialog.The most recent version of bsdinstall does not seem to respect any ofthe checkboxes in the "Choose the services you would like to be startedat boot" dialog. None of the chosen services end up in the rc.conf filethat is installed onto the target system.This is caused by the bsdinstall/scripts/hardening script, whichimplements the new hardening options dialog. The script starts byoverwriting the previously written rc.conf.services file: echo -n > $BSDINSTALL_TMPETC/rc.conf.serviceswhich is obviously incorrect. It should clear out rc.conf.hardeninginstead.Reviewed by: allanjudePR: 211506MFC after: 3 daysDifferential Revision: https://reviews.freebsd.org/D7387 List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening

0e3f233f - Add new System Hardening menu and options to bsdinstall.

Fri, 15 Jul 2016 15:07:24 +0000

Add new System Hardening menu and options to bsdinstall.This patch add new 'hardening' file responsible for new bsdinstall'System Hardening' menu allowing users to set some sane and carefullypicked system security options (like random process id's, hidingother users/groups processes and others).All options are OFF by default in this patch due to POLA principlewith intention to turn change some of them to ON by default in future.Reviewed by: adrian, allanjude, bdrewery, nwhitehornApproved by: adrian, allanjudeMFC after: 7 days List of files: /freebsd-14.2/usr.sbin/bsdinstall/scripts/hardening