Things to Do After Installing FreeBSD | Hacker News Reader

Things to Do After Installing FreeBSD

bastillebsd.org

35 pointsnixcraft7 comments

Interesting. I wish there were some more explanation about why you would make these changes.

it's pretty much standard sysadmin things - not the author but try to explain each point in a little bit more detail anyway:

1. .hushlogin - I guess just personal preference - if you log in often it's nice to have

2. patches - update the box - same as apt-get update && apt-get upgrade on linux. doing this on fresh install is always a good idea.

3. atime=off - atime = access time is another metadata write on read and it's often not required and therefore disabled. There are some applications that depend of atime but it's a common performance improvement because you don't want to have writes when reading something - even if it's just metadata.

4. a list of tools the author uses.

5. make the shell nicer, also subjective

6. same as setting up sudo in linux but doas is more modern. You don't want to work as root all the time to reduce fatal errors and for security.

7. there are some theoretic attacks on dsa/ecdsa algorithms and I guess that's why these are disabled. Probably a good idea but there are millions of hosts with dsa/ecdsa ssh keys and nothing has happenend as far as I know.

8. default deny firewall rule that only allows ssh is always a good idea on a host that is on the internet. Automatic bots exploit anything pretty fast and quite a lot of software is reachable via internet by default without any security measures.

9. metrics - monitoring is always a good idea it's much easier to know what's going on and you can analyse / pinpoint problems much easier using some graphs. i.e. when did the network-traffic/cpu exploded - when did the disk fill up? node-exporter is pretty much the weapon of choice nowadays for that. Additional collectors for time (ntp) and disk stats are useful i.e. to alert if ntp doesn't work and to get some idea about device-utilisation.

10. bastille looks a tool for container deployments? https://bastillebsd.org/

b1. microcode has some relavance to security/cpu-bugs always a good idea for servers.

b2. correct time is super important. Lot's of stuff will break in subtle ways if the time is off - i.e. SAML/Kerberos etc.pp

b3. if your ssd/hdd is dying you will get an email if configured correctly.

I've never used doas, I have only used sudo and I'm just curious if anyone could explain the differences and maybe why one would use doas over sudo? Or sudo over doas?

I've just never really thought about using anything besides sudo until now. :)

doas is the openbsd people going "sudo is too complex and is therefore insecure".

it has a way simpler config and way smaller source. it also may or may not be fully functional on linux at any given time as it likes to use openbsd kernel apis. for instance on linux by default you must supply a password every time you invoke doas, unlike sudo which provides a temporary session for the tty you authenticate against. doas supports such a session on openbsd, but relies on kernel timers, so by default that functionality is disabled in linux.

Ah, interesting! Very good to know, thank you for the detailed and concise explanation.

Sudo project means more source code == more bugs. doas is from OpenBSD, less and clean code == less bugs. At least, that is how I see it. I wrote last C code 15+ years back so you might as well ignore my comment ;)

It seems to me like based on this information doas would be simpler and more secure. Another comment brought up that doas is available on Linux but doesn't function as well because kernel timers are disabled. This made me wonder: is doas not as popular as sudo because sudo functions the same across Unix-like platforms where doas doesn't?

I wonder this because doas seems like it is superior but I rarely see how-to documentation (on Linux, at least) that uses anything aside from sudo (or just su) for privilege escalation.

Reply on news.ycombinator.com