Services and Updating

This paper results like many other papers on the Internet. In this article we wish to make a FreeBSD machine configured as well as possible to resist all kinds of threats. It is kind of a compilation of knowledge, which we need. Security is a process not a product; this is why we try in this document to approach a broad panel of subjects and uses. We will be basing this paper on the 4.x-Stable FreeBSD branch. This paper will also be split up into several sections, which will be posted throughout the next couple weeks. I'm also taking into consideration you are very familiar with the FreeBSD operating system.

The topics we will be covering are in today's paper are:

1. Intro
1.1. Services
1.2. CVSup
1.3. Updating your system


1. Intro

I'm hoping by now you have successfully installed FreeBSD correctly, and that you have arrived to a stable connection to the Internet. If you have not I suggest doing a search on on how to overcome your obstacles. In this chapter we will concentrate on the basic system configuration of FreeBSD, the first measures in which you will apply from a point of view of safety.


1.1. Services

Inetd service is super a daemon which makes it possible to launch several network services as well as part of their configuration like ftpd, smptd or telnetd. The file of configuration for inetd is preserved in /etc/inetd.conf. Here is an extract:

ftp stream TCP nowait root/usr/libexec/ftpd ftpd - L
# Shell stream TCP nowait root/usr/libexec/rshd rshd

In general, one places a comment ('#') in front of the line on the services we do not wish to load. If we do not wish to run any of these services inetd may be disabled though your rc.conf. If you wish to disable inetd you also give up the option for TCP Wrappers used by default in FreeBSD. Normally our first step is to determine what services are listening on a port. There's 2 good ways to do this, by using either netstat or the sockstat utility, both part of the base FreeBSD installation.

($:~)=> netstat -a | grep 'listen'

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp4       0      0 *:ssh                   *:*                     LISTEN
tcp4       0      0 *:ftp                   *:*                     LISTEN
tcp4       0      0 *:smtp                  *:*                     LISTEN
udp4       0      0 *:portmap               *:*                     LISTEN

Or my personal favorite is the sockstat command

($:~)=> sockstat -46

The -46 Tells sockstat to display open sockets on both IPv4 and IPv6 network stacks.

As you see we probably do not want all of these services. But if your machine is going to become a waiter with multiple services, I recommend that you follow our solution. In short, all the network services you wish to use in the future will turn in the shape of a stand alone daemon, by doing it this way it lets the daemons increase safety but also simplifying the configuration and the speed of response of the services by eliminating the inetd service. To make sure that inetd does not launch on the next boot we add 1 simple line to our /etc/rc.conf file.

($:~)=> vi /etc/rc.conf

inetd_enable="NO"

If you wish to use the inetd service you would use a line similar to this:

inetd_enable="YES"
inetd_flags="-WW"

With inetd set to YES it will be launched upon every boot up. The options -Ww tells inetd to carry out the capacity of filtering of the internal services and external TCP via TCP Wrappers, which we will not be using in the course of this article. So go ahead and set inetd_enable="NO" and comment out the inetd_flags line. Next we also want to disable the portmapper service. Portmapper is an extremely practical tool within the framework of services such as RPC and NFS. But it also presents a incalculable number of vulnerabilities. So while still inside the rc.conf file we add the following line:

portmap_enable="NO"

Now we should probably kill the current inetd service running. By adding the line to the rc.conf we tell the system that we don't want to load it upon startups, but it does not tell it to kill the current running process.

($:~)=> killall inetd

NOTE: It is very important to know that your rc.conf file is used to configure the programs or scripts and starting daemons upon startup of your system.


1.2 CVSup

One of the biggest strengths of FreeBSD is the ability to update the whole OS from source code; this makes updating the OS an easy task. It can save FreeBSD administrator a lot of time tracking down bug fixes and patches. Now there's a couple ways to get cvsup installed. And there's also 2 cvsup's depending which one you want. You have cvsup (this one has a gui for xwindows) or you have cvsup-without-gui (this is for a system w/ out xwindows) but for this article I'm going to use the no-gui one. One way you can install cvsup is with the packaging system. We will go into detail about the packaging system and ports tree later at a later time.

($:~)=> pkg_add -r cvsup-without-gui

Now if the package system is not your cup of tea you can also use the ports tree. If you've never used the ports tree before this is what makes FreeBSD such a great operating system. So if you installed the ports collection you can

($:~)=> cd /usr/ports/net/cvsup-without-gui ; make install clean

So now we go onto method 3 of how to install this.

($:~)=> /stand/sysinstall

Welcome back to the installer app. Normally I try to stay away from automated things like this to do my bidding. But I'm not fully going to go into the packaging system yet.

By syncro
05 Dec 2003