从头开始强化 BSD
我知道 Hardened Linux from Scratch 项目，该项目为您提供了逐步- 完全从源代码构建您自己的定制和强化的 Linux 系统的步骤说明。 我想知道BSD中相当于什么？
I am aware of the Hardened Linux from Scratch project which is a project that provides you with step-by-step instructions for building your own customized and hardened Linux system entirely from source. I would like to know what is the equivalent in BSD?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
正如 Richard 所说，OpenBSD 绝对值得一试，对于专用于防火墙和网关的所有产品，它是我的第一选择。 对于其他服务，我倾向于坚持使用 FreeBSD，尽管没有明显的理由，这只是个人喜好。
但我想指出，如果您想要更安全地托管服务，那么使用“从头开始”的概念可以更好地完成 监狱。 本质上，您在完整的 FreeBSD 安装上创建了一个有限的 FreeBSD 环境。 在该有限的环境中，您只能复制/链接服务运行所需的那些二进制文件和文件。
由于托管服务无法访问任何其他文件/二进制文件，因此这些内容中的所有潜在安全缺陷都无法被利用。 如果您的应用程序偶然被“root”，它不会超出监狱的范围。
将其视为一个具有可忽略的性能损失的类固醇沙箱。
As Richard said OpenBSD is definitely worth a go, it is my #1 choice for everything that is dedicated for firewalls and gateways. For other services I tend to stick to FreeBSD although there is no obvious reason for it just a personal preference.
But I would like to point out that the from 'scratch part' concept if you want to do more secure hosting of a service can be much better done using Jails. In essence you create a limited FreeBSD environment on an a full FreeBSD install. In that limited environment you only copy/link those binaries and files that the service requires to run.
Because the hosted service has no access to any other files/binaries, all the potential security flaws in those things aren't open to exploit. If by chance your application gets 'rooted' it will not go beyond the boundaries of the jail.
See it like a sandbox on steroids with neglectable performance penalties.
OpenBSD 在安装时“默认”就得到了强化。 只有管理员才能打开它......逐个组件。
[更新]虽然我还没有阅读强化Linux的文档...一些相同的事情可能适用...例如它们都使用OpenSSH，所以策略是相同的。 因此，如果存在模块重叠，则同样适用。
OpenBSD is hardened "by default" from the installation. Only the admin opens it up... component by component.
[UPDATE] while I have not read the document for hardening linux... some of the same things might apply... for example they both use OpenSSH so the strategies would be the same. So where there is module overlap the same would apply.
你并不是真的从头开始做 bsd。 所有主要项目都在单个源存储库中提供了完整的系统，因此您不会从这里获取内核，从那里获取 binutils 和编译器，从其他地方获取 c 库和标准实用程序，从另一个地方获取 X。
它们通常比普通的 Linux 发行版更容易获取所有源代码并重建整个系统，但这并不是真正的定制任何东西。
您可以尝试做一些疯狂的事情，例如尝试让 OpenBSD 用户区在具有 FreeBSD 端口的 NetBSD 内核上运行，但您只能靠自己，而且它肯定不会被“强化”。
You don't really do bsd 'from scratch'. All of the major projects come with a complete system in a single source repository so you're not grabbing a kernel from here, binutils and compiler from over there and c libraries and standard utilities from somewhere else and X from yet another place.
They are generally easier to get all the source for and to rebuild the entire system than your average linux distro, but that's not really customizing anything.
You could try to do something nuts, like perhaps trying to get the OpenBSD userland to run on a NetBSD kernel with FreeBSD ports, but you'd be on your own and it certainly wouldn't be 'hardened'.
HardenedBSD 是 FreeBSD 项目的一个分支，旨在实现 PIE、RELRO、SAFESTACK、CFIHARDEN。 有些目标已经存在，有些则处于极端状态。 我不认为它“准备好生产”，但可以用作桌面（也取决于生产环境要求）。
仓库：https://github.com/HardenedBSD
一切，包括“make buildworld/buildkernel”都与FreeBSD 和手册很好地解释了这一点。 即使来自 Linux 领域，您也需要阅读一些内容。 构建自己的端口本身就是一个完整的主题。
关于监狱，这种说法并不完全正确。 虽然确实添加了一个重要的安全层，但 Unix 系统（关于 Linux 的 IDK）[引用此处]“缺乏内核漏洞利用缓解措施。如果攻击者获得了对监狱的访问权限，那么通过内核转向其他监狱或升级权限并不需要太多工作开发。” 不要误会我的意思，我几乎把所有的服务都尽可能地放在监狱里。
至于“默认情况下强化”的评论：这一切都在 sysctl 设置中，可以在每个 *BSD 风格上进行调整，但是如果系统管理员不花时间阅读文档，那么秒措施几乎毫无用处。
如果你有兴趣，你的作业：https://www.freebsd.org/doc/handbook/< /a>
HardenedBSD is a fork of the FreeBSD project with the aim of implementing PIE, RELRO, SAFESTACK, CFIHARDEN. Some goals are there, others are extreme-WIP. I wouldn't consider it as "ready for production" yet, but usable as desktop (also depends on production env requirements).
Repo: https://github.com/HardenedBSD
Everything, including "make buildworld/buildkernel" is the same as on FreeBSD and the Handbook does a good job of explaining this. You'll have a bit of reading to do though even coming from linux-land. Building your own ports is an entire topic in it's self.
Re jails, the statement is not entirely correct. While certainly adding an important security layer, Unix systems (IDK about Linux) [quoting here] "lack kernel exploit mitigations. If an attacker gains access to a jail, it's not too much work to pivot to other jails or escalate privileges via a kernel exploit." Don't misunderstand me, I place almost every service in a jail as much possible.
As to "Hardened by default" comment: It's all in the sysctl settings which can be tweaked on every *BSD flavor, but sec measures are pretty much useless if the sysadmin does not take time to read the docs.
If you are interested, your homework: https://www.freebsd.org/doc/handbook/