FreeBSD 12.1系统安全配置与防火墙管理

freebsd-update fetch
freebsd-update install
portsnap fetch update
pkg update && pkg upgrade -y

# /etc/pf.conf 配置示例
ext_if = "em0"
block in all
pass out all keep state
set skip on lo0
pass in on $ext_if proto tcp to ($ext_if) port 2222 keep state
pass in on $ext_if proto tcp to ($ext_if) port 80,443 keep state

# 启动PF
echo 'pf_enable="YES"' >> /etc/rc.conf
service pf start

# /etc/sysctl.conf
net.inet.icmp.drop_redirect=1
net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1
net.inet.tcp.syncookies=1

# 用户管理
pw useradd admin -m -G wheel -s /usr/local/bin/bash
passwd admin
pkg install -y sudo
echo 'admin ALL=(ALL) ALL' >> /usr/local/etc/sudoers

echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
service sshd restart

# 文件系统权限掩码
echo 'umask 027' >> /etc/profile

# 重要文件加不可变标志
chflags schg /etc/rc.conf
chflags schg /etc/pf.conf
chflags schg /etc/ssh/sshd_config
# 查看文件标志
ls -lo /etc/rc.conf

# 移除不可变标志
chflags noschg /etc/rc.conf

# 配置自动挂载选项
cat >> /etc/fstab << 'EOF'
/dev/da0p2 / ufs rw,noatime,acls 1 1
/dev/da0p3 /var ufs rw,noatime,noexec,nosuid 1 1
/dev/da0p4 /tmp ufs rw,noatime,noexec,nosuid 1 1
/dev/da0p5 /home ufs rw,noatime,nosuid 1 1
EOF

# 限制inetd服务
# 查看 /etc/inetd.conf，注释不需要的服务

# 禁用不必要的服务
cat >> /etc/rc.conf << 'EOF'
sendmail_enable="NONE"
linux_enable="NO"
nfs_server_enable="NO"
sshd_enable="YES"
ntpd_enable="YES"
EOF

# TCP Wrappers配置（如使用）
cat >> /etc/hosts.allow << 'EOF'
sshd: 192.168.0.0/16 : allow
sshd: ALL : deny
EOF

# 定期更新ports
portsnap fetch update

# 使用pkg管理包
pkg update
pkg upgrade

# 检查已知漏洞
pkg audit -F

# 查看已安装包
pkg info

# 删除未使用的依赖
pkg autoremove