I found a list on this 2010 document: sshd, bgpd, ntpd, ospfd, dvrmpd, ospf6d, spamd, relayd, ripd, pflogd, snmpd, hostapd, smtpd, tmux, ypldap, ldpd, syslogd, mopd, bind. I can also see on my router that the following programs have both a root process and an unprivileged child : ntpd, sshd, syslogd, pflogd, named, openvpn, and even tcpdump (which is in addition chrooted). First one is to lock down your router from a running system. It is wise to wait that our router is fully functionnal before enabling securelevel 1, as it can prevent us from modifying the system or loading kernel drivers on the fly (which is the whole point of securelevel). On top of this, additional drivers are rarely needed for non-Apple products, and I can’t think of the last time I plugged a non-Apple device into my Mac that Mac OS didn’t recognize. Jails are only a piece of it, they should not be underestimated, neither should they be overestimated.

For a complete article about FreeBSD and jails you can check my previous article FreeBSD Gateway Hardening : Jails & Intrusion Detection With Snort. Also, when upgrading for instance from FreeBSD 10.1 to 10.x, once the host is upgraded, every jail will have to be upgraded from sources as well. Indeed if a jail with such right is hacked, there is no need for the intruder to break out of the jail, he can just sniff out all of your traffic. By default a jail is very restricted, and programs inside cannot do a simple ping or sniff the network interface traffic. The attacker then can monitor all of your network traffic and maybe even access the hard disk of your laptop. Then there is the FreeBSD Mandatory Access Control (MAC) framework. Let’s say you want the resources in a subnet to have Internet access. Let me hasten to say that despite what I’ve quoted above, neither the Acting Commissioner nor upper management at Social Security is brain dead. Despite the growing investment of research and interest in human security, to date, there is no real consensus on what can or should constitute the focus of what are still loosely termed human security studies.

Wayfinding Optimisation: This technique is specially used when the event is organized on the international level and attendees coming from all over the world are not familiar with the venue. Those seven questions will garner the vast majority of information you’ll have to make an educated decision on your own financial advisor’s level of experience. Making LTD the primary payor would completely change the insurance product and make it much, much more expensive. MAC framework has not much documentation except the FreeBSD handbook, which got me lost at first read. Then, both OS have different security features: systrace for OpenBSD, and MAC and Jails for FreeBSD. 1 (by default) which enables the isolation of users except root (same effect as above without MAC). I put them in /root as it should only be used by the root account, and this directory is accessible in single user mode as long as / is mounted, even if other partitions are not or cannot be.

This unlocking script can only be ran from single user mode. Once again, not a single security feature is bullet proof, but used together with what we have talked about above, it can greatly raise the bar for the attacker. While it loads the french keyboard layout, you have to modify this line to your language (or remove it). While on OpenBSD it is possible to combine chroot and systrace to sandbox a program, FreeBSD provides on its side a feature called Jails. On FreeBSD side, the privilege separation is handled by the recent Capsicum feature. Capsicum is used by FreeBSD to harden OpenSSH built-in privilege separation explained above. Both OpenBSD and FreeBSD take privilege separation seriously. When we have strong memory protection in place, true randomness, cryptography, and privilege separation as a core rule, what can we do to harden the system further? The application being sandboxed, its file reading requests will be delegated to a trusted component operating outside the sandbox, ensuring privilege separation.