3
votes
4answers
2k views

How to grant su access without password to one user only in wheel group (FreeBSD)?

I know how to enable su without a password for all wheel group users by adding the appropriate configuration line in /etc/pam.d/su. I do not want to enable this for all wheel users but only one ...
5
votes
1answer
309 views

Block Google requests to 16k using pf firewall

I'd like to block access to Google search using PF after the threshold of 17500 requests (connection established) in 24h, from a host running FreeBSD 9. What I came up with, after reading pf-faq is ...
0
votes
1answer
170 views

Provide Internet access for different VLAN

I have several managed switches at work that connect all computer within our office to the ADSL modem. However I would like enforce a VLAN policy to isolate traffic within the network. Through my ...
13
votes
3answers
1k views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
0
votes
1answer
3k views

How to chroot VirtualHosts on a Apache server?

I have a FreeBSD server (company's OS of choice). Currently we run several websites on each of the webservers. Websites are in PHP which is run in Apache Module mode. At the Apache is not chrooted so ...
3
votes
2answers
247 views

Digitally signed FreeBSD package

In nasty world of Windows you can digitally sign installation package (exe) and during installation check if its authentic or not. Any idea how to check same under FreeBSD(preferably in conjunction ...
1
vote
3answers
327 views

Most secure webserver software

I was reading about Hiawatha and I was wondering if really Freebsd+Hiawatha could be considered safer than Linux+Lighttpd or any other webserver. Moreover, if you were to have to host a very ...
4
votes
1answer
133 views

How do I securly update a *BSD system?

Security is a major concern. Every major Linux distribution uses signed packages. But the FreeBSD systems in the office downloading unsigned packages/ports via FTP. Is there a solution that would ...
2
votes
1answer
72 views

monitoring a network for spammers/webscripts gone bad

I am going to be setting aside some IP space so that someone can use it as co-lo space and dedicated hosting. The network will have its own cisco router and several L2 managed switches that I'll admin ...
3
votes
5answers
2k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
0
votes
5answers
447 views

TCP attack invisible to netstat

we are hit by a strange attack, the attacker even emailed to challenge us. The output of "netstat -n" is just a few "ESTABLISHED" and "TIME_WAIT" typically, yet the server's website cannot be reached ...
21
votes
10answers
4k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
2
votes
3answers
979 views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
0
votes
1answer
374 views

What are the alternatives to using allow.sysvipc in a jail running PostgreSQL in FreeBSD

This question is prompted by this one. I've set up a jail to run PostgreSQL but without allow.sysvipc when creating the jail (or setting the relevant rc.conf entries), the system call to shmget are ...
2
votes
1answer
390 views

What are the security implications of using allow.sysvipc in a FreeBSD jail

The man page for jail says that allow.sysvipc enables "System V primitives [to] share a single namespace across the host and jail environments..." thus "... processes within a jail would be able to ...
2
votes
1answer
625 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
2answers
616 views

Securing access through specific ports on public IP address

We have public IP address hosted on FreeBSD router. We have also a lot of service running inside our LAN network, some of our services need to be accessible outside our home network trough public IP ...
2
votes
4answers
207 views

Looking for FTP server recommendations for BSD [closed]

I'm currently deciding on what ftp server we should use for an internal system that we have running FreeBSD 6.2. The requirements that we'll need are the following: must be able to handle SSL, as ...
3
votes
4answers
506 views

Best tools for keeping a FreeBSD 7.x system up to date?

I have had on-and-off contact with FreeBSD for 15 years, but I haven't maintained a FreeBSD system since 4.x. Now I need to install and maintain a couple of 7.x systems; first for development, then an ...
2
votes
2answers
369 views

FreeBSD security log message: “Received data after socket was closed”

I am running FreeBSD 7 and I get this in /var/log/security : +++ /tmp/security.AIKARuA1 2009-06-30 03:05:17.000000000 +0500 +TCP: [69.147.83.36]:80 to [115.186.130.56]:50488 tcpflags ...