DOCSLIB.ORG

FREEBSD Ransomware / Incidents of the Last Weeks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
FREEBSD Ransomware / Incidents of the Last Weeks FREENAS MINI FREENAS STORAGE APPLIANCE CERTIFIED IT SAVES YOUR LIFE. STORAGE How important is your data? with over six million downloads, As one of the leaders in the storage industry, you Freenas is undisputedly the most know that you’re getting the best combination of hardware designed for optimal performance Years of family photos. Your entire music popular storage operating system and movie collection. Ofce documents with FreeNAS. Contact us today for a FREE Risk in the world. you’ve put hours of work into. Backups for Elimination Consultation with one of our FreeNAS experts. Remember, every purchase directly supports every computer you own. We ask again, how Sure, you could build your own FreeNAS system: the FreeNAS project so we can continue adding important is your data? research every hardware option, order all the features and improvements to the software for years parts, wait for everything to ship and arrive, vent at to come. And really - why would you buy a FreeNAS customer service because it hasn’t, and fnally build it server from anyone else? now imaGinE LosinG it aLL yourself while hoping everything fts - only to install the software and discover that the system you spent Losing one bit - that’s all it takes. One single bit, and days agonizing over isn’t even compatible. Or... your fle is gone. The worst part? You won’t know until you makE it Easy on yoursELF absolutely need that fle again. Example of one-bit corruption As the sponsors and lead developers of the FreeNAS project, iXsystems has combined over 20 years of tHE soLution hardware experience with our FreeNAS expertise to The FreeNAS Mini has emerged as the clear choice to the mini boasts these state-of-the- bring you FreeNAS Certifed Storage. We make it save your digital life. No other NAS in its class ofers art features: easy to enjoy all the benefts of FreeNAS without ECC (error correcting code) memory and ZFS bitrot the headache of building, setting up, confguring, protection to ensure data always reaches disk t DPSF()[*OUFM¥"UPNQSPDFTTPS and supporting it yourself. As one of the leaders in Freenas 1u t 6QUP5#PGTUPSBHFDBQBDJUZ t *OUFM¥9FPO¥1SPDFTTPS&W'BNJMZ without corruption and never degrades over time. the storage industry, you know that you’re getting the t (#PG&$$NFNPSZ XJUIUIFPQUJPOUPVQHSBEF t 6QUP5#PGTUPSBHFDBQBDJUZ best combination of hardware designed for optimal UP(# t (#&$$NFNPSZ VQHSBEBCMFUP(# No other NAS combines the inherent data integrity t Y(JHBCJUOFUXPSLDPOUSPMMFST performance with FreeNAS. t Y(JHBCJU&UIFSOFUDPOUSPMMFST t 3FNPUFNBOBHFNFOUQPSU *1.* and security of the ZFS flesystem with fast on-disk t 3FEVOEBOUQPXFSTVQQMZ t 5PPMMFTTEFTJHOIPUTXBQQBCMFESJWFUSBZT encryption. No other NAS provides comparable power t 'SFF/"4JOTUBMMFEBOEDPOöHVSFE Every Freenas server we ship is... and fexibility. The FreeNAS Mini is, hands-down, the Freenas 2u t Y*OUFM¥9FPO¥1SPDFTTPST&W'BNJMZ best home and small ofce storage appliance you can »$VTUPNCVJMUBOEPQUJNJ[FEGPSZPVSVTFDBTF t 6QUP5#PGTUPSBHFDBQBDJUZ buy on the market. When it comes to saving your »*OTUBMMFE DPOöHVSFE UFTUFE BOEHVBSBOUFFEUPXPSLPVU t (#&$$NFNPSZ VQHSBEBCMFUP(# important data, there simply is no other solution. PGUIFCPY t Y(C&/FUXPSLJOUFSGBDF 0OCPBSE 6QHSBEBCMFUPY(JHBCJU*OUFSGBDF »4VQQPSUFECZUIF4JMJDPO7BMMFZUFBNUIBUEFTJHOFEBOE t 3FEVOEBOU1PXFS4VQQMZ CVJMUJU »#BDLFECZBZFBSTQBSUTBOEMBCPSMJNJUFEXBSSBOUZ http://www.iXsystems.com/mini 2 http://www.iXsystems.com/storage/freenas-certifed-storage/ Intel, the Intel logo, Intel Atom and Intel Atom Inside are trademarks of Intel Corporation in the U.S. and/or other countries. Intel, the Intel logo, the Intel Inside logo and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries. FREENAS MINI FREENAS STORAGE APPLIANCE CERTIFIED IT SAVES YOUR LIFE. STORAGE How important is your data? with over six million downloads, As one of the leaders in the storage industry, you Freenas is undisputedly the most know that you’re getting the best combination of hardware designed for optimal performance Years of family photos. Your entire music popular storage operating system and movie collection. Ofce documents with FreeNAS. Contact us today for a FREE Risk in the world. you’ve put hours of work into. Backups for Elimination Consultation with one of our FreeNAS experts. Remember, every purchase directly supports every computer you own. We ask again, how Sure, you could build your own FreeNAS system: the FreeNAS project so we can continue adding important is your data? research every hardware option, order all the features and improvements to the software for years parts, wait for everything to ship and arrive, vent at to come. And really - why would you buy a FreeNAS customer service because it hasn’t, and fnally build it server from anyone else? now imaGinE LosinG it aLL yourself while hoping everything fts - only to install the software and discover that the system you spent Losing one bit - that’s all it takes. One single bit, and days agonizing over isn’t even compatible. Or... your fle is gone. The worst part? You won’t know until you makE it Easy on yoursELF absolutely need that fle again. Example of one-bit corruption As the sponsors and lead developers of the FreeNAS project, iXsystems has combined over 20 years of tHE soLution hardware experience with our FreeNAS expertise to The FreeNAS Mini has emerged as the clear choice to the mini boasts these state-of-the- bring you FreeNAS Certifed Storage. We make it save your digital life. No other NAS in its class ofers art features: easy to enjoy all the benefts of FreeNAS without ECC (error correcting code) memory and ZFS bitrot the headache of building, setting up, confguring, protection to ensure data always reaches disk t DPSF()[*OUFM¥"UPNQSPDFTTPS and supporting it yourself. As one of the leaders in Freenas 1u t 6QUP5#PGTUPSBHFDBQBDJUZ t *OUFM¥9FPO¥1SPDFTTPS&W'BNJMZ without corruption and never degrades over time. the storage industry, you know that you’re getting the t (#PG&$$NFNPSZ XJUIUIFPQUJPOUPVQHSBEF t 6QUP5#PGTUPSBHFDBQBDJUZ best combination of hardware designed for optimal UP(# t (#&$$NFNPSZ VQHSBEBCMFUP(# No other NAS combines the inherent data integrity t Y(JHBCJUOFUXPSLDPOUSPMMFST performance with FreeNAS. t Y(JHBCJU&UIFSOFUDPOUSPMMFST t 3FNPUFNBOBHFNFOUQPSU *1.* and security of the ZFS flesystem with fast on-disk t 3FEVOEBOUQPXFSTVQQMZ t 5PPMMFTTEFTJHOIPUTXBQQBCMFESJWFUSBZT encryption. No other NAS provides comparable power t 'SFF/"4JOTUBMMFEBOEDPOöHVSFE Every Freenas server we ship is... and fexibility. The FreeNAS Mini is, hands-down, the Freenas 2u t Y*OUFM¥9FPO¥1SPDFTTPST&W'BNJMZ best home and small ofce storage appliance you can »$VTUPNCVJMUBOEPQUJNJ[FEGPSZPVSVTFDBTF t 6QUP5#PGTUPSBHFDBQBDJUZ buy on the market. When it comes to saving your »*OTUBMMFE DPOöHVSFE UFTUFE BOEHVBSBOUFFEUPXPSLPVU t (#&$$NFNPSZ VQHSBEBCMFUP(# important data, there simply is no other solution. PGUIFCPY t Y(C&/FUXPSLJOUFSGBDF 0OCPBSE 6QHSBEBCMFUPY(JHBCJU*OUFSGBDF »4VQQPSUFECZUIF4JMJDPO7BMMFZUFBNUIBUEFTJHOFEBOE t 3FEVOEBOU1PXFS4VQQMZ CVJMUJU »#BDLFECZBZFBSTQBSUTBOEMBCPSMJNJUFEXBSSBOUZ http://www.iXsystems.com/mini http://www.iXsystems.com/storage/freenas-certifed-storage/ 3 Intel, the Intel logo, Intel Atom and Intel Atom Inside are trademarks of Intel Corporation in the U.S. and/or other countries. Intel, the Intel logo, the Intel Inside logo and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries. EDITOR’S WORD Dear Readers, It is nice to meet you again and present to you with the next BSD issue. I hope you will find the articles interesting and eventually learn many useful tips and tricks. This time, I want to focus on short but useful hints that will help you in your daily tasks. Enjoy reading and share your thoughts with me. For those of you who prefer to visit our website, I want to start publishing some of the articles from the BSD magazine online on our blog. I am doing this for convenience purposes so that those of you who do not have time to read the issue all at once but prefer to visit our website more often to search easily for the most-wanted information can do so with ease. If you have your favourite articles that you think should be published, please feel free to contact me. Also, I plan to organise a contest to choose the best articles that were written in the first half of 2017. I hope you like the idea and you will take part in it. I will publish more details on the BSD magazine website and in our newsletter. That’s all for my announcements, but I would like to add that I’m still looking for new ideas for topics on articles. I look forward to your emails and your suggestions on what is new and trending. You can always reach me at [email protected]. Having said that, let us now see what we have inside this BSD magazine issue. Carlos will refresh his own article for you to remind you about debugging skills. In his tutorial, he used a real life situation where debugging skills will save us time, headaches and possibly find a solution with a minimal amount of effort. For those of you who want to know more about DevOps, please go to E.G Nadhan. He will explain what he has in mind. The definition that he compiled is based upon myriad interpretations that he has come across in his interactions with his peers, as well as customers, partners, service providers and colleagues t colleagues over social media. I would like to highlight two articles for this month. The first one is ZFS Feature Flags written by Natalia Portillo. It is a great article which offers an easy explanation for those who want to know more about ZFS feature flags. The second one was written by Abdorrahman Homaei entitled SSH Hardening with Google Authenticator and OpenPAM. From this article, you will learn about techniques one of which is called 2-Step Verification.
Load more

Recommended publications
  • Freenas® 11.0 User Guide
    FreeNAS® 11.0 User Guide June 2017 Edition FreeNAS® IS © 2011-2017 iXsystems FreeNAS® AND THE FreeNAS® LOGO ARE REGISTERED TRADEMARKS OF iXsystems FreeBSD® IS A REGISTERED TRADEMARK OF THE FreeBSD Foundation WRITTEN BY USERS OF THE FreeNAS® network-attached STORAGE OPERATING system. VERSION 11.0 CopYRIGHT © 2011-2017 iXsystems (https://www.ixsystems.com/) CONTENTS WELCOME....................................................1 TYPOGRAPHIC Conventions...........................................2 1 INTRODUCTION 3 1.1 NeW FeaturES IN 11.0..........................................3 1.2 HarDWARE Recommendations.....................................4 1.2.1 RAM...............................................5 1.2.2 The OperATING System DeVICE.................................5 1.2.3 StorAGE Disks AND ContrOLLERS.................................6 1.2.4 Network INTERFACES.......................................7 1.3 Getting Started WITH ZFS........................................8 2 INSTALLING AND UpgrADING 9 2.1 Getting FreeNAS® ............................................9 2.2 PrEPARING THE Media.......................................... 10 2.2.1 On FreeBSD OR Linux...................................... 10 2.2.2 On WindoWS.......................................... 11 2.2.3 On OS X............................................. 11 2.3 Performing THE INSTALLATION....................................... 12 2.4 INSTALLATION TROUBLESHOOTING...................................... 18 2.5 UpgrADING................................................ 19 2.5.1 Caveats:............................................
    [Show full text]
  • Mysql NDB Cluster 7.5.16 (And Later)
    Licensing Information User Manual MySQL NDB Cluster 7.5.16 (and later) Table of Contents Licensing Information .......................................................................................................................... 2 Licenses for Third-Party Components .................................................................................................. 3 ANTLR 3 .................................................................................................................................... 3 argparse .................................................................................................................................... 4 AWS SDK for C++ ..................................................................................................................... 5 Boost Library ............................................................................................................................ 10 Corosync .................................................................................................................................. 11 Cyrus SASL ............................................................................................................................. 11 dtoa.c ....................................................................................................................................... 12 Editline Library (libedit) ............................................................................................................. 12 Facebook Fast Checksum Patch ..............................................................................................
    [Show full text]
  • Pluggable Authentication Modules
    Who this book is written for This book is for experienced system administrators and developers working with multiple Linux/UNIX servers or with both UNIX and Pluggable Authentication Windows servers. It assumes a good level of admin knowledge, and that developers are competent in C development on UNIX-based systems. Pluggable Authentication Modules PAM (Pluggable Authentication Modules) is a modular and flexible authentication management layer that sits between Linux applications and the native underlying authentication system. The PAM framework is widely used by most Linux distributions for authentication purposes. Modules Originating from Solaris 2.6 ten years ago, PAM is used today by most proprietary and free UNIX operating systems including GNU/Linux, FreeBSD, and Solaris, following both the design concept and the practical details. PAM is thus a unifying technology for authentication mechanisms in UNIX. This book provides a practical approach to UNIX/Linux authentication. The design principles are thoroughly explained, then illustrated through the examination of popular modules. It is intended as a one-stop introduction and reference to PAM. What you will learn from this book From Technologies to Solutions • Install, compile, and configure Linux-PAM on your system • Download and compile third-party modules • Understand the PAM framework and how it works • Learn to work with PAM’s management groups and control fl ags • Test and debug your PAM confi guration Pluggable Authentication Modules • Install and configure the pamtester utility
    [Show full text]
  • Why Did We Choose Freebsd?
    Why Did We Choose FreeBSD? Index Why FreeBSD in General? Why FreeBSD Rather than Linux? Why FreeBSD Rather than Windows? Why Did we Choose FreeBSD in General? We are using FreeBSD version 6.1. Here are some more specific features which make it appropriate for use in an ISP environment: Very stable, especially under load as shown by long-term use in large service providers. FreeBSD is a community-supported project which you can be confident is not going to 'go commercial' or start charging any license fees. A single source tree which contains both the kernel and all the rest of the code needed to build a complete base system. Contrast with Linux that has one kernel but hundreds of distributions to choose from, and which may come and go over time. Scalability features as standard: e.g. pwd.db (indexed password database), which give you much better performance and scales well for very large sites. Superior TCP/IP stack that responds well to extremely heavy load. Multiple firewall packages built in to the base system (IPF, IPFW, PF). High-end debugging and tracing tools, including the recently announced port of the Sun Dynamic Tracing tool, DTrace, to FreeBSD. Ability to gather fine-grained statistics on system performance using many included utilities like systat, gstat, iostat, di, swapinfo, disklabel, etc. Items such as software RAID are supported using multiple utilities (ata, ccd. vinum, geom). RAID-1 using GEOM Mirror (see gmirror) supports identical disk sets, or identical disk slieces. Take a look at the most stable web sites according to NetCraft (http://news.netcraft.com/archives/2006/06/06/six_hosting_companies_most_reliable_hoster_in_may.html).
    [Show full text]
  • Truenas® 11.3-U5 User Guide
    TrueNAS® 11.3-U5 User Guide Note: Starting with version 12.0, FreeNAS and TrueNAS are unifying (https://www.ixsystems.com/blog/freenas- truenas-unification/.) into “TrueNAS”. Documentation for TrueNAS 12.0 and later releases has been unified and moved to the TrueNAS Documentation Hub (https://www.truenas.com/docs/). Warning: To avoid the potential for data loss, iXsystems must be contacted before replacing a controller or upgrading to High Availability. Copyright iXsystems 2011-2020 TrueNAS® and the TrueNAS® logo are registered trademarks of iXsystems. CONTENTS Welcome .................................................... 8 Typographic Conventions ................................................ 9 1 Introduction 10 1.1 Contacting iXsystems ............................................... 10 1.2 Path and Name Lengths ............................................. 10 1.3 Using the Web Interface ............................................. 12 1.3.1 Tables and Columns ........................................... 12 1.3.2 Advanced Scheduler ........................................... 12 1.3.3 Schedule Calendar ............................................ 13 1.3.4 Changing TrueNAS® Settings ...................................... 13 1.3.5 Web Interface Troubleshooting ..................................... 14 1.3.6 Help Text ................................................. 14 1.3.7 Humanized Fields ............................................ 14 1.3.8 File Browser ................................................ 14 2 Initial Setup 15 2.1 Hardware
    [Show full text]
  • BSD UNIX Toolbox 1000+ Commands for Freebsd, Openbsd
    76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page i BSD UNIX® TOOLBOX 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iv BSD UNIX® Toolbox: 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD® Power Users Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-37603-4 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data is available from the publisher. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permis- sion should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions.
    [Show full text]
  • Bsdcan 2015 UCL Working Group
    BSDCan 2015 UCL Working Group [email protected] Overview The goal of this working group is to develop a template for all future configuration files that is both human readable and writable, but is also hierarchical, expressive, and programmatically editable. Agenda ● Opening: What is UCL ● Presentation of work in progress: converting newsyslog and bhyve to UCL ● Discuss common requirements for configuration files ● Develop a common set of grammar/keys to work across all configuration files ('enabled' activates/deactivates each block, allows disabling default configuration without modifying the default files, ala pkg) Agenda (Continued) ● Discuss layering (/etc/defaults/foo.conf -> /etc/foo.conf -> /etc/foo.conf.d/*.conf -> /usr/local/etc/foo.conf.d/*.conf) ● Discuss required features for management utilities (uclcmd) ● Identify additional targets to UCL-ify ● Develop a universal API for using libucl in various applications, simplify loading configuration into C structs (libfigpar?) What is the Universal Configuration Language? ● Inspired by bind/nginx style configuration ● Fully compatible with JSON, but more liberal in what it accepts, so users do not have to write strict JSON ● Can Output UCL, JSON, or YAML ● Supports handy suffixes like k, mb, min, d ● Can be as simple or as complex as required ● Allows inline comments (# and /* multiline */) ● Validation and Schema support ● Supports includes, macros, and variables Why UCL is great -- all of this is valid param = value; key = “value”; flag = true; section { number = 10k string
    [Show full text]
  • Sysadmin Documentation Documentation Release 1.0
    Sysadmin Documentation Documentation Release 1.0 Alexander Werner Nov 05, 2018 Contents: 1 FreeBSD 3 1.1 Resources.................................................3 1.2 Installation of software..........................................3 1.3 Update of software............................................3 1.4 System update..............................................4 1.5 Change system configuration......................................4 2 MariaDB Galera Cluster 5 2.1 Tasks...................................................5 3 PF - FreeBSD Packet Filter 7 3.1 Installation................................................7 3.2 Configuration...............................................7 4 Unbound DNS 9 4.1 Installation................................................9 4.2 Configuration...............................................9 5 ZFS 11 5.1 Installation................................................ 11 5.2 Operation................................................. 11 6 Setup of Debian 9 on a Lenovo Thinkpad 470 13 6.1 Preparation................................................ 13 6.2 Booting the Installer........................................... 13 6.3 Partitioning the disk........................................... 14 6.4 Software selection............................................ 14 6.5 Finishing the setup............................................ 14 6.6 Post-Setup................................................ 14 7 Resources 15 8 Indices and tables 17 i ii Sysadmin Documentation Documentation, Release 1.0 This manual serves as
    [Show full text]
  • Freebsd Foundation February 2018 Update
    FreeBSD Foundation February 2018 Update Upcoming Events Message from the Executive Director Dear FreeBSD Community Member, AsiaBSDCon 2018 Welcome to our February Newsletter! In this newsletter you’ll read about FreeBSD Developers Summit conferences we participated in to promote and teach about FreeBSD, March 8-9, 2018 software development projects we are working on, why we need Tokyo, Japan funding, upcoming events, a release engineering update, and more. AsiaBSDCon 2018 Enjoy! March 8-11, 2018 Tokyo, Japan Deb SCALE 16x March 8-11, 2018 Pasadena, CA February 2018 Development Projects FOSSASIA 2018 March 22-25, 2018 Update: The Modern FreeBSD Tool Chain: Singapore, Singapore LLVM's LLD Linker As with other BSD distributions, FreeBSD has a base system that FreeBSD Journal is developed, tested and released by a single team. Included in the base system is the tool chain, the set of programs used to build, debug and test software. FreeBSD has relied on the GNU tool chain suite for most of its history. This includes the GNU Compiler Collection (GCC) compiler, and GNU binutils which include the GNU "bfd" linker. These tools served the FreeBSD project well from 1993 until 2007, when the GNU project migrated to releasing its software under the General Public License, version 3 (GPLv3). A number of FreeBSD developers and users objected to new restrictions included in GPLv3, and the GNU tool chain became increasingly outdated. The January/February issue of the FreeBSD Journal is now available. Don't miss articles on The FreeBSD project migrated to Clang/LLVM for the compiler in Tracing ifconfig Commands, Storage FreeBSD 10, and most of GNU binutils were replaced with the ELF Tool Multipathing, and more.
    [Show full text]
  • Lynx-Lynxos-Datasheet
    Certifiable RTOS for safety-critical computing The world’s most powerful, open-standards real-time OS LynxOS® 7.0 is a deterministic, hard, to develop highly secure devices for the real-time operating system that provides Internet of Things, maximizing their POSIX-conformant APIs in a small foot- availability and uptime and resistance to print em bedded kernel. LynxOS provides potential cyber threats. Advanced embedded symmetric multi-processing support to take development tools enable fast and efficient • Mission-critical performance and full advantage of multi-threaded applica- deployment of these technologies. reliability—absolute determinism and linear performance scalability tions running on multi-core processors. Included are advanced tool chains, debug- LynxOS supports the most popular reference • Industry-leading openness— gers, and cross-development host support. targets within the Intel and PowerPC archi- Full POSIX conformance LynxOS provides open APIs, robust support tectures including the new 4th generation for the latest networking and I/O technolo- Intel® Core™ i7 and Core™ i5, in addition • Latest technologies for Internet gies, and state-of-the-art security features. to the Freescale QorIQ ‘P’ and ‘T’ communications—advanced series processors. networking feature sets for rapid development of LynxOS is already installed on millions of differentiated products devices worldwide. With the introduction All embedded market segments, includ- of new and easy to implement security func- ing military, aerospace, industrial, medical, tionality, both existing and new customers automotive, and office automation benefit can effectively secure their next generation from these security and networking im- of devices. LynxOS 7 implements a layered provements realized in this next generation LynxOS Ensures: approach to security that allows customers of LynxOS architecture.
    [Show full text]
  • Freebsd Advanced Security Features
    FreeBSD Advanced Security Features Robert N. M. Watson Security Research Computer Laboratory University of Cambridge 19 May, 2007 Introduction ● Welcome! – Introduction to some of the advanced security features in the FreeBSD operating system ● Background – Introduce a series of access control and audit security features used to manage local security – Features appeared between FreeBSD 4.0 and FreeBSD 6.2, and build on the UNIX security model – To talk about new security features, we must understand the FreeBSD security architecture 19 May 2007 2 Post-UNIX Security Features ● Securelevels ● IPFW, PF, IPFilter ● Pluggable ● KAME IPSEC, authentication FAST_IPSEC modules (OpenPAM) ● Access control lists ● Crypto library and (ACLs) tools (OpenSSL) ● Security event audit ● Resource limits ● Mandatory access ● Jails, jail securelevels control (MAC) ● GBDE, GELI ● 802.11 security 19 May 2007 3 Brief History of the TrustedBSD Project ● TrustedBSD Project founded in April, 2000 – Goal to provide trusted operating system extensions to FreeBSD – DARPA funding began in July, 2001 – Continuing funding from a variety of government and industry sponsors – Work ranges from immediately practical to research – While many of these features are production- quality, some are still under development – Scope now also includes Apple's Mac OS X 19 May 2007 4 FreeBSD Security Architecture 19 May 2007 5 FreeBSD Security Architecture ● FreeBSD's security architecture is the UNIX security architecture – Entirely trusted monolithic kernel – UNIX process model – Kernel UIDs/GIDs driven by user-space user mode – Privileged root user – Various forms of access control (permissions, ...) ● Security features discussed here extend this security model in a number of ways 19 May 2007 6 Kernel and User Processes Kernel s s Inter-process e l c l communication c a a c m m e e t t s s y y s s e l i F User User User ..
    [Show full text]
  • Freenas® 11.2-U3 User Guide
    FreeNAS® 11.2-U3 User Guide March 2019 Edition FreeNAS® is © 2011-2019 iXsystems FreeNAS® and the FreeNAS® logo are registered trademarks of iXsystems FreeBSD® is a registered trademark of the FreeBSD Foundation Written by users of the FreeNAS® network-attached storage operating system. Version 11.2 Copyright © 2011-2019 iXsystems (https://www.ixsystems.com/) CONTENTS Welcome .............................................................. 8 Typographic Conventions ..................................................... 10 1 Introduction 11 1.1 New Features in 11.2 .................................................... 11 1.1.1 RELEASE-U1 ..................................................... 14 1.1.2 U2 .......................................................... 14 1.1.3 U3 .......................................................... 15 1.2 Path and Name Lengths .................................................. 16 1.3 Hardware Recommendations ............................................... 17 1.3.1 RAM ......................................................... 17 1.3.2 The Operating System Device ........................................... 18 1.3.3 Storage Disks and Controllers ........................................... 18 1.3.4 Network Interfaces ................................................. 19 1.4 Getting Started with ZFS .................................................. 20 2 Installing and Upgrading 21 2.1 Getting FreeNAS® ...................................................... 21 2.2 Preparing the Media ...................................................
    [Show full text]