System Admin Simplified

IPFW is one of several firewalls included in FreeBSD by default. It has a command-line tool to handle the policies for incoming and outgoing connections. In the configurations discussed here, network connections "from any to any" are deliberately avoided to prevent potential bounce attacks from happening, if the server is not intended to act as a router. Instead, a request/respond or incoming/outgoing rule pair is adopted to direct the flow of network traffic. The main objective is to set up IPFW to block unauthorized remote access to unsecured ports on the server. But if attackers manage to break in through a vulnerability on some programs running on authorized incoming ports, the outgoing restrictions will prevent massive data exfiltration, stopping intruders dead in their tracks. A similar approach can be done on Debian-based Linux distributions using UFW . ========== 1. STRICT CONFIGURATION 1.1. Create a custom shell script for IPFW commands. root@host: #  ee /etc/...

After enabling HTTPS on the web server in FreeBSD, remote users can be redirected to this secure protocol by automatically rewriting the URL. ========== 1. Log in to "root". Regular users must be part of the "wheel" group in order to do this. user@host: $ su - 2. Open the Apache main configuration file. root@host: # ee /usr/local/etc/apache24/httpd.conf 3. Find and uncomment the following Apache directives. # BEGIN CODE # ... LoadModule rewrite_module libexec/apache24/mod_rewrite.so # Apache rewrite engine Include etc/apache24/Includes/*.conf # Custom configuration files # ... # END CODE 4. Create a custom config file in the "Includes" directory. root@host: # ee /usr/local/etc/apache24/Includes/myrewrite.conf 5. Place the following code in the custom config file. # BEGIN CODE # ... RewriteEngine On # Enables directives for rewriting. RewriteCond %{HTTPS} !=on # Verifies that the connection is not yet in HTTPS. RewriteRule ^/?(.*) https://%{SERVER_NAME}/$...

The following procedure activates HTTPS for the Apache web server in FreeBSD. This secure protocol uses TLS/SSL certificates to encrypt the data transferred between the remote user and the web server. Sensitive information is protected from being captured by malicious actors using sniffing tools along the network route. ========== 1. PREREQUISITES 1.1. Make a self-signed SSL certificate. [  Details  ] 2. ACTIVATION 2.1. Log in to "root". Regular users must be part of the "wheel" group in order to do this. user@host: $ su - 2.2. Open the Apache main configuration file. root@host: # ee /usr/local/etc/apache24/httpd.conf 2.3. Find and uncomment the following Apache directives. # BEGIN CODE # ... LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so # Needed by the "SSLSessionCache" directive in httpd-ssl.conf # ... LoadModule ssl_module libexec/apache24/mod_ssl.so # Needed by the "SSLCipherSuite" directive in httpd-ssl.conf # ... ...

The following procedure shows how to apply self-signed certificates to the Apache web server in FreeBSD. After  creating and installing the TLS/SSL certificate/key pair, they can be utilized to secure FreeBSD web services with encryption during the development and testing process. It is important to keep in mind that self-signing may be deemed UNTRUSTWORTHY in a production environment. ========== 1. Log in to "root". Regular users must be part of the "wheel" group in order to do this. user@host: $ su - 2. Go to the directory containing the Apache site configuration files. root@host: # cd /usr/local/etc/apache24/extra 3. BACK UP the default HTTPS configuration file for the secure site. root@host: # cp httpd-ssl.conf httpd-ssl-conf.back 4. Open the default HTTPS configuration file. root@host: # ee httpd-ssl.conf 5. Find and modify the following Apache directives. # BEGIN CODE # ... SSLCertificateFile "/usr/local/etc/apache24/server.crt" # The self-signe...

Hide server details from potential online threats in a few easy steps. ========== 1. Log in to "root". Regular users must be part of the "wheel" group in order to do this. user@host: $ su - 2. Open the Apache main configuration file. root@host: # ee /usr/local/etc/apache24/httpd.conf 3. Find and uncomment the following Apache directive. # BEGIN CODE # ... Include etc/apache24/extra/httpd-default.conf # Default config for the Apache web server. # ... # END CODE 4. Open the Apache default settings configuration file. root@host: # ee /usr/local/etc/apache24/extra/httpd-default.conf 5. Find and modify the following Apache directives. # BEGIN CODE # ... ServerTokens Prod # "Prod" reduces Apache info sent by the server in its HTTP response header. # ... ServerSignature Off # "Off" removes info on server, host, and port from error pages and other auto-generated docs. # ... # END CODE 6. Open the PHP configuration file. root@host: # ee /usr/local/etc/ph...

The following procedure activates HTTPS for the Home Assistant server. The secure protocol uses TLS/SSL certificates to encrypt the data transferred between user and server. Although it is possible to make this home automation system, whether in  Linux or  FreeBSD , accessible over the Internet, Home Assistant is usually operated within private networks, either physical or virtual. In this case, self-signed certificates may be acceptable to use and quicker to deploy. ========== 1. Log in as the system account. 1.1. Linux, with $HOME "bin" included in $PATH (-i) of system account (-u). user@host: $ sudo -i -u homeassistant 1.2. FreeBSD, coming from "root" superuser. root@host: # su - homeassistant 2. Go to the Home Assistant configuration directory. user@host: $ cd ~/.homeassistant 3. Make a directory for SSL certificates. user@host: $ mkdir ssl 4. Ensure that only the system account and members of its group can access the directory. user@host:...

Content management systems like Drupal require specific web server directives in order to work properly. The following steps enable Apache to recognize .htaccess files containing those specific web server directives. The steps outlined here require the use HTTPS for better security on both Debian-based Linux distributions and the FreeBSD operating system . ========== 1. DEBIAN-BASED LINUX DISTRIBUTIONS 1.1. Go to the directory containing the Apache site configuration files. user@host: $ cd /etc/apache2/sites-available 1.2.  BACK UP the default HTTPS configuration file for the secure site. user@host: $ sudo cp 000-default-ssl.conf 000-default-ssl-conf.back 1.3. Open the default HTTPS configuration file. user@host: $ sudo nano 000-default-ssl.conf 1.4. Find the "DocumentRoot" section and add the "Directory" block marked "For Drupal" as follows. # BEGIN CODE <IfModule mod_ssl.c>         <VirtualHost _default_:443> # .....