Synopsis #
A security baseline is the smallest documented state that can be reviewed repeatedly. It is not a universal list of tunables. Begin with supported software, known accounts, intended listening services, explicit firewall policy, protected credentials, recoverable data, and logs that can show change.
Add securelevels, file flags, MAC policies, or custom kernel settings only for a stated threat and an understood recovery path. Controls that prevent routine recovery can reduce availability without addressing the likely attack.
Use Choose a MAC policy before introducing a mandatory access-control module, and Audit security-relevant activity before treating an audit trail as complete attribution. Both controls require deliberate event or policy scope, storage, review, and recovery.
Confirm support and maintenance ownership #
Record the installed release and package repositories:
$ freebsd-version -kru
$ pkg repositories
Compare the release with Supported FreeBSD releases , which is maintained from the official support table . Define who reviews security advisories, who applies base-system and package updates, and how a failed update is recovered.
The update decision guide separates base, package, and release operations. A ZFS-root host should also have a documented boot-environment recovery path before risky changes.
Audit accounts and privilege paths #
Review local accounts, groups, shells, and privilege-bearing memberships:
$ pw usershow -a
$ pw groupshow -a
$ awk -F: '{print $1, $3, $7}' /etc/passwd
Disable or remove accounts through their owning system or package procedure. Do not edit password hashes by hand. Record:
- who can log in interactively;
- who can become root and through which mechanism;
- which SSH keys and multi-factor controls protect remote administration;
- which service accounts own writable data;
- where recovery credentials are stored.
Inventory network exposure #
List listening sockets and active firewall policy:
$ sockstat -4 -6 -l
# pfctl -sr
# pfctl -sn
Use the firewall command that matches the configured firewall; PF output is not evidence for an IPFW host. Every listening socket should have an owner, intended client network, authentication boundary, update path, and log location.
Bind administrative services to a management interface or private network where practical. A firewall complements service configuration; it does not make an unnecessary daemon necessary.
Audit third-party packages #
Refresh the vulnerability database and inspect installed packages:
# pkg audit -F
Treat the result as input to a change decision. An affected package may need an upgrade, removal, service disablement, or documented mitigation. A clean package audit does not cover the FreeBSD base system; FreeBSD security advisories and errata remain separate sources.
Preserve configuration evidence #
Track intentional changes to /etc, /usr/local/etc, firewall rules, loader settings, jail definitions, and deployment scripts in protected version control or configuration management. Keep secrets out of the same repository unless it is explicitly designed and encrypted for them.
FreeBSD supplies tools for comparing system files and supports file flags, ACLs, process accounting, and other controls. Introduce each only with an owner and review procedure. A control that nobody checks is not monitoring.
Protect recovery #
Security includes availability and integrity:
- maintain independent backups;
- test restoration under a non-production path;
- retain console access before remote firewall or SSH changes;
- protect encryption keys separately from encrypted data;
- monitor pool, filesystem, and backup health;
- record the order needed to restore identity, DNS, time, and applications.
Ransomware-resistant or administrator-error-resistant retention requires a destination that compromised host credentials cannot freely rewrite.
Review the baseline #
Review after each release upgrade and whenever network exposure, administrators, or critical workloads change. Record exceptions with an expiry or review date rather than allowing temporary access to become invisible policy.