🛡️

FreeBSD Hardening Hub

MAC Framework & System Auditing

FreeBSD 14+ Ready 🌐 Español
🌐 Español

Production Hardening Strategy

This interactive application converts the FreeBSD technical security guide into an explorable operational dashboard. Traditional UNIX models delegate complete control to the superuser (root/UID 0). By deploying the MAC Framework (Mandatory Access Control) and CAPP / OpenBSM Auditing, we drastically reduce the attack surface by partitioning privileges, restricting kernel system calls, and guaranteeing tamper-proof event records.

MAC Module 🌐

mac_portacl

Bind privileged ports (<1024) without requiring UID 0 root access.

Status: Dynamic Load
MAC Module ⏱️

mac_ntpd

Clock synchronization reserved for NTP daemon without global privileges.

Target: UID 123 (ntp)
MAC Module 👁️

mac_seeotheruids

Process tree isolation between users with explicit GID monitoring exceptions.

Isolation: Granular
Kernel Core 🔑

Kernel DDB Hardening

Production debugger control: unattended compilation or debugger omission.

Level: Kernel RAM Anti-dump

📜 The 3 Pillars of System Auditing & Integrity

1. Software

pkg audit

Cross-references installed packages against official vulnerability databases (VuXML) in real-time or via automated daily checks.

2. Syscalls

OpenBSM auditd

Cryptographically records logins, administrative actions, and kernel system calls. Built on CAPP security evaluation standards.

3. Base System

freebsd-update IDS

Compares local SHA-256 binary checksums against signed release manifests published by the FreeBSD Release Engineering team.