9.6 KiB

Raw Blame History

FreeBSD notes

VIM

Disable mouse

echo "set mouse-=a" >> ~/.vimrc

Mac keyboard backspace fix

set backspace=indent,eol,start

OpenSSH daemon & client

Set settings in sshd_config:

Banner /etc/ssh/banner.txt

#################################################################
#                   _    _           _   _                      #
#                  / \  | | ___ _ __| |_| |                     #
#                 / _ \ | |/ _ \ '__| __| |                     #
#                / ___ \| |  __/ |  | |_|_|                     #
#               /_/   \_\_|\___|_|   \__(_)                     #
#                                                               #
#  You are entering into a secured area! Your IP, Login Time,   #
#   Username has been noted and has been sent to the server     #
#                       administrator!                          #
#   This service is restricted to authorized users only. All    #
#            activities on this system are logged.              #
#  Unauthorized access will be fully investigated and reported  #
#        to the appropriate law enforcement agencies.           #
#################################################################

To reduce OS fingerprinting

VersionAddendum none

debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8
debug1: compat_banner: match: OpenSSH_8.8 pat OpenSSH* compat 0x04000000

instead of:

debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8 FreeBSD-20211221
debug1: compat_banner: match: OpenSSH_8.8 FreeBSD-20211221 pat OpenSSH* compat 0x04000000

OpenSSH daemon faster connection dropping

Restricting users by not allowing explicit ssh access can improve your ssh server connections. In the default FreeBSD /etc/ssh/sshd_config configuration the MaxAuthTries is 3. Which means all system users can try up to 3 times before the connection is gracefull dropped.

We will create an explicit ssh group to have fine control over who may login over ssh and who is directly disconnected. By enabling this, an attacker could guess user account names if there are authentication tries or not.

SSH for the root user is always a bad idea, but in some setups it is necessary. For the truely paranoid root user access can be further restricted based on IP address and ssh-key only.

The normal behaviour when ssh to a machine wil look like this even with PermitRootLogin no set:

jerry@jerrys-MacBook-Pro ~ % ssh 192.168.2.100 -lroot
Password for root@pineapple.xor-gate.org:
Password for root@pineapple.xor-gate.org:
Password for root@pineapple.xor-gate.org:
root@192.168.2.100: Permission denied (publickey,keyboard-interactive).

When the global MaxAuthTries 0 and a match block is used then the connection is immediatelly dropped:

jerry@jerrys-MacBook-Pro ~ % ssh 192.168.2.100 -lroot
Received disconnect from 192.168.2.100 port 22:2: Too many authentication failures
Disconnected from 192.168.2.100 port 22

MaxAuthTries 0

Match Group ssh
        MaxAuthTries 3

Protecting SSH with sshguard on pf

Install ssh guard

# pkg install sshguard

Modify (or create) /etc/pf.conf with the sshguard firewall table. First we block all traffic. Also double check you don't have a rule before the SSHGuard rule that allows access.

ext_if = igb0

table <sshguard> persist

block all

block drop in log quick on $ext_if inet from <sshguard> to any

pass in

Enable pf firewall in the rc.conf

pf_enable="YES"
pf_rules="/etc/pf.conf"

# service pf reload
Reloading pf rules.
pfctl: /dev/pf: No such file or directory

The pf kernel device node doesn't exist so it is not loaded

# kldload pf

Or start pf using the rc script:

# /etc/rc.d/pf start

To show the blocked IPs use pfctl show and clear on the sshguard table:

pfctl -t sshguard -T show
pfctl -t sshguard -T flush

This slows down brute-force attacks:

Mar 25 07:44:29 pineapple sshd[87092]: Disconnecting invalid user pi 118.161.193.40 port 54511: Too many authentication failures [preauth]
Mar 25 07:45:07 pineapple sshd[87166]: error: maximum authentication attempts exceeded for root from 118.161.193.40 port 54556 ssh2 [preauth]
Mar 25 07:45:07 pineapple sshd[87166]: Disconnecting authenticating user root 118.161.193.40 port 54556: Too many authentication failures [preauth]
Mar 25 07:45:29 pineapple sshd[87808]: Invalid user oracle from 118.161.193.40 port 54563
Mar 25 07:45:29 pineapple sshd[87808]: error: maximum authentication attempts exceeded for invalid user oracle from 118.161.193.40 port 54563 ssh2 [preauth]
Mar 25 07:45:29 pineapple sshd[87808]: Disconnecting invalid user oracle 118.161.193.40 port 54563: Too many authentication failures [preauth]
Mar 25 07:45:44 pineapple sshd[88058]: Invalid user sFTPUser from 118.161.193.40 port 54598

Reverse shell

Reverse target system: ssh -R <remote port>:<local host>:<local port> <remote host>
Control system: ssh -p <remote port> localhost

https://jfrog.com/connect/post/reverse-ssh-tunneling-from-start-to-end/ https://moreillon.medium.com/ssh-reverse-shells-5094d9be2094

User management

Set default shell

For existing users, use the chsh command (“change shell”):

chsh -s SHELL USER
chsh -s /usr/local/bin/bash root

For future users:

Edit /etc/pw.conf defaultshell keywords When use adduser(), choose necessary shell

Add new group and add user to group

root@pineapple:/home/jerry # pw group add ssh
root@pineapple:/home/jerry # pw user mod jerry -G wheel,ssh,jerry
root@pineapple:/home/jerry # groups jerry
jerry wheel jerry ssh

Changing user information (interactive)

chfn or chpass

Securing

https://fleximus.org/howto/secure-freebsd

Networking

https://www.cyberciti.biz/faq/freebsd-unix-force-dhcp-client-to-get-a-new-lease/

Hardware info

https://www.cyberciti.biz/tips/freebsd-display-information-about-the-system.html

dmidecode
sysctl -a hw.model
uname -mrs
pciconf -lv
usbconfig
camcontrol devlist

Disk

https://linuxhint.com/list-disks-freebsd/

geom disk list
sysctl kern.disks
gpart show ada0

Jails on ZFS

We run Jails on ZFS subvolumes to easily create, destory and manage the jails

zfs create zpool/jails
zfs set mountpoint=/data/jails zpool/jails
zfs create zpool/jails/<jailname>

Create /etc/jail.conf (see man jail.conf)

# Typical static defaults:
# Use the rc scripts to start and stop jails.  Mount jail's /dev.
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown jail";
exec.clean;
mount.devfs;

# Dynamic wildcard parameter:
# Base the path off the jail name.
path = "/data/jails/$name";

gitea {
	ip4.addr = 192.168.2.200;
}

Enable jail service /etc/rc.conf

jail_enable="YES"

Use bsdinstall to download a FreeBSD installation. NOTE for installation FTP client (proxy) must be allowed in the firewall. Or a HTTP mirror must be selected...

# bsdinstall jail /here/is/the/jail

Start all jails or single

service jail start
service jail start <jailname>

Don't forget to install SSH for easy management to the jail (instead of chrooting into the folder)

chroot /here/is/the/jail
pkg install ssh

Enable ssh in /etc/rc.conf

sshd_enable="YES"

vi /etc/ssh/sshd_config
# change the PermitRootLogin line to "yes" and remove the comment sign at the start
sysrc sshd_enable="YES"
service sshd start
passwd
# enter root password for your jail's root user

Restart jail

service jail restart <jailname>

PF firewall enable FTP client using ftpproxy

Install ftp proxy

pkg install ftpproxy

bhyve vm manager

https://github.com/churchers/vm-bhyve

Virtual networking

vxnet

I'll try to create a complete guide soon. But here's step 1 of doing it manually just to get the jails on separate hosts to talk to each other. (using vxlan)

Assuming your external interface is named em0 on both hosts and each is assigned an IP address of 192.168.0.10, and 192.168.0.11 respectively.

First configure Bastille (minus the pf.conf) per Bastille docs

Jail host 1:

route add -net 224/8 -interface em0

ifconfig vxlan create vxlanid 42 vxlanlocal 192.168.0.10 vxlangroup 224.0.2.6 vxlandev em0 inet 10.10.99.2/24

bastille create testjail 13.2-RELEASE 10.10.99``.20 vxlan0

Jail host 2:

route add -net 224/8 -interface em0

ifconfig vxlan create vxlanid 42 vxlanlocal 192.168.0.11 vxlangroup 224.0.2.6 vxlandev em0 inet 10.10.99.3/24

bastille create testjail 13.2-RELEASE 10.10.99``.30 vxlan0

https://www.reddit.com/r/freebsd/comments/160uss5/comment/jxq4cax/?utm_source=share&utm_medium=web2x&context=3

Networking

Show active internet connections: netstat Show open sockets: sockstat

Installing updates: fix IGNORE_OSVERSION

root@pineapple:/home/jerry # pkg update
Updating FreeBSD repository catalogue...
Fetching data.pkg: 100%    7 MiB   7.4MB/s    00:01
Processing entries:   0%
Newer FreeBSD version for package zziplib:
To ignore this error set IGNORE_OSVERSION=yes
- package: 1303001
- running kernel: 1302001
Ignore the mismatch and continue? [y/N]: y

WARNING: FreeBSD 13.2-RELEASE-p4 HAS PASSED ITS END-OF-LIFE DATE.
Any security issues discovered after Tue Jul  2 02:00:00 CEST 2024
will not have been corrected.

freebsd-update fetch
freebsd-update install

Specific release upgrade freebsd-update upgrade -r 13.3-RELEASE

9.6 KiB Raw Blame History

FreeBSD notes

VIM

OpenSSH daemon & client

OpenSSH daemon faster connection dropping

Protecting SSH with sshguard on pf

User management

Set default shell

Add new group and add user to group

Changing user information (interactive)

Securing

Networking

Hardware info

Jails on ZFS

PF firewall enable FTP client using ftpproxy

bhyve vm manager

Virtual networking

Networking

Installing updates: fix IGNORE_OSVERSION

9.6 KiB

Raw Blame History