CIS FreeBSD 14 Benchmark

This recommendation verifies that /tmp is mounted with noexec,nosuid,nodev on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check /tmp mount options:
mount | grep '/tmp '
grep '/tmp' /etc/fstab

# Mount /tmp as separate partition with noexec,nosuid,nodev:
# Edit /etc/fstab:
echo 'tmpfs  /tmp  tmpfs  rw,nosuid,noexec,nodev,size=2g  0  0' >> /etc/fstab
mount -o remount /tmp

This recommendation verifies that /var is a separate partition on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check /var mount:
mount | grep '/var '
grep '/var' /etc/fstab

# Ensure /var is a separate partition:
# During install: create /var as distinct ZFS dataset or UFS slice
zfs create -o mountpoint=/var zroot/var

This recommendation verifies that /home has nosuid option on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check /home mount options:
mount | grep '/home '
grep '/home' /etc/fstab

# Add nosuid to /home partition:
# /etc/fstab entry:
# /dev/gpt/home  /home  ufs  rw,nosuid  2  2
mount -o remount /home

This recommendation verifies that inetd is disabled on the FreeBSD 14 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the FreeBSD 14 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check if inetd is running:
service inetd status
grep 'inetd_enable' /etc/rc.conf

# Disable inetd:
sysrc inetd_enable=NO
service inetd stop

This recommendation verifies that NFS server is not running unless required on the FreeBSD 14 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the FreeBSD 14 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check NFS status:
service nfsd status
service mountd status
grep 'nfs_server_enable' /etc/rc.conf

# Disable NFS server:
sysrc nfs_server_enable=NO
sysrc mountd_enable=NO
service nfsd stop
service mountd stop

This recommendation verifies that sendmail is disabled if not needed on the FreeBSD 14 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the FreeBSD 14 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check for sendmail:
service sendmail status
grep 'sendmail_enable' /etc/rc.conf

# Disable sendmail if not needed:
sysrc sendmail_enable=NONE
sysrc sendmail_submit_enable=NO
sysrc sendmail_outbound_enable=NO
sysrc sendmail_msp_queue_enable=NO
service sendmail stop

This recommendation verifies that IP forwarding is disabled on the FreeBSD 14 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the FreeBSD 14 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check IP forwarding:
sysctl net.inet.ip.forwarding
sysctl net.inet6.ip6.forwarding

# Disable IP forwarding:
sysrc gateway_enable=NO
sysctl net.inet.ip.forwarding=0
sysctl net.inet6.ip6.forwarding=0

# Persist in /etc/sysctl.conf:
echo 'net.inet.ip.forwarding=0' >> /etc/sysctl.conf
echo 'net.inet6.ip6.forwarding=0' >> /etc/sysctl.conf

This recommendation verifies that ICMP redirects are not accepted on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ICMP redirects:
sysctl net.inet.icmp.drop_redirect
sysctl net.inet.ip.redirect

# Disable ICMP redirects:
sysctl net.inet.icmp.drop_redirect=1
sysctl net.inet.ip.redirect=0

# Persist:
echo 'net.inet.icmp.drop_redirect=1' >> /etc/sysctl.conf
echo 'net.inet.ip.redirect=0' >> /etc/sysctl.conf

This recommendation verifies that PF firewall is enabled and configured on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check PF firewall status:
pfctl -s info
pfctl -s rules
cat /etc/pf.conf

# Enable PF firewall:
sysrc pf_enable=YES
sysrc pflog_enable=YES

# Basic /etc/pf.conf:
# block all
# pass out on egress proto { tcp udp } all
# pass in on egress proto tcp to port { 22 }

service pf start

This recommendation verifies that strong password policy is configured on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check password policy:
grep 'minpasswordlen\|passwordtime' /etc/login.conf
cat /etc/login.conf | grep -A5 ':default:'

# Set password policy in /etc/login.conf:
# default:\
#    :passwd_format=sha512:\
#    :minpasswordlen=14:\
#    :passwordtime=90d:\
#    :mixpasswordcase=true:

cap_mkdb /etc/login.conf

This recommendation verifies that sudo is installed and configured on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check sudo configuration:
cat /usr/local/etc/sudoers | grep -v '^#' | grep -v '^$'
ls -la /usr/local/etc/sudoers.d/

# Configure sudo with least privilege:
pkg install sudo
visudo
# Add: %wheel ALL=(ALL) ALL
# Remove: ALL ALL=(ALL) NOPASSWD: ALL

This setting ensures that direct root login is restricted on the FreeBSD 14 Unix operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the FreeBSD 14 Unix operating system is essential for defense in depth.

# Check root login restrictions:
grep 'PermitRootLogin' /etc/ssh/sshd_config
grep 'console' /etc/ttys | head -3

# Restrict root login:
# In /etc/ssh/sshd_config:
# PermitRootLogin no
service sshd restart

# Restrict root TTY login:
# Edit /etc/ttys: set 'secure' to 'insecure' for virtual terminals

This recommendation verifies that strong SSH ciphers and key exchange algorithms on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH protocol and crypto:
sshd -T | grep -E 'protocol|ciphers|macs|kexalgorithms'

# Harden SSH in /etc/ssh/sshd_config:
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,diffie-hellman-group16-sha512

service sshd restart

This recommendation verifies that SSH idle timeout and auth limits are set on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH settings:
sshd -T | grep -E 'maxauthtries|logingracetime|x11forwarding|permitemptypasswords'

# Set SSH hardening parameters in /etc/ssh/sshd_config:
MaxAuthTries 4
LoginGraceTime 60
X11Forwarding no
PermitEmptyPasswords no
ClientAliveInterval 300
ClientAliveCountMax 3

service sshd restart

This recommendation verifies that BSM audit subsystem is enabled on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit configuration:
auditd -s
cat /etc/security/audit_control
service auditd status

# Enable audit subsystem:
sysrc auditd_enable=YES

# Configure /etc/security/audit_control:
dir:/var/audit
flags:lo,aa,ad,fd,fc,fm,fw,-ex
minfree:5
naflags:lo,aa
policy:cnt,argv
filesz:10M

service auditd start

This recommendation verifies that syslog forwards to remote server on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
cat /etc/syslog.conf | grep -v '^#' | grep -v '^$'
service syslogd status

# Configure remote syslog:
# Add to /etc/syslog.conf:
# *.*    @logserver.example.com

sysrc syslogd_flags='-ss'
service syslogd restart

This recommendation verifies that security patches are applied regularly on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pkg audit:
pkg audit -F
freebsd-update IDS

# Enable automatic security updates:
# Create /etc/periodic.conf:
echo 'daily_status_security_pkgaudit_enable="YES"' >> /etc/periodic.conf

# Apply FreeBSD security patches:
freebsd-update fetch
freebsd-update install

This recommendation verifies that correct permissions on sensitive files on the FreeBSD 14 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeBSD 14 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check file permissions on critical files:
ls -la /etc/master.passwd /etc/passwd /etc/group /etc/login.conf
stat -f '%Sp %OLp %Su:%Sg %N' /etc/master.passwd

# Set correct permissions:
chmod 600 /etc/master.passwd
chmod 644 /etc/passwd
chmod 644 /etc/group
chown root:wheel /etc/master.passwd /etc/passwd /etc/group