Hardened BSD: A Security-Enhanced FreeBSD Fork
Hardened BSD: A Security-Enhanced FreeBSD Fork
Welcome to this week's BSD Synergy article, where we dive into Hardened BSD - a security-focused fork of FreeBSD that brings much-needed security features to the BSD ecosystem.
The Origin Story
Hardened BSD began in 2013 as a project with a simple goal: to implement Address Space Layout Randomization (ASLR) in FreeBSD. The initiative was spearheaded by Oliver Pinter and Shawn Webb, who initially hoped to contribute these security enhancements back to the FreeBSD project.
However, their attempt to upstream ASLR into FreeBSD faced significant resistance and controversy. After reviewing the archived email threads and forum discussions surrounding this effort, it's clear there was considerable drama within the community about implementing this security feature. Eventually, the developers made the decision to stop trying to upstream their work and instead devoted their efforts to creating Hardened BSD as a standalone security-enhanced FreeBSD derivative.
What Makes Hardened BSD Different?
What began as a single security enhancement has evolved into a comprehensive security project with multiple layers of protection. Hardened BSD now implements numerous security features and mitigations that create what security professionals refer to as "defense in depth" - multiple layers of security that protect your system even if one layer is compromised.
Currently, Hardened BSD offers stable releases based on FreeBSD 10 and FreeBSD 11. These releases are updated frequently with security patches - the most recent stable build (as of the time of the original recording) was released on January 29, 2017, primarily addressing OpenSSL vulnerabilities.
Feature Comparison
One of the most useful resources on the Hardened BSD website is their feature comparison chart, which clearly shows how their security features stack up against other BSD variants. According to this comparison:
- Hardened BSD offers the most comprehensive security features
- OpenBSD follows with a strong security focus
- NetBSD implements some security features
- FreeBSD has notably fewer security enhancements
Some key security features in Hardened BSD include:
- Address Space Layout Randomization (ASLR)
- Position Independent Executables (PIE)
- ASLR brute force protection with SegVGuard
- SysCtl hardening
- Network stack hardening
- Boot process hardening
- Trusted path execution
- Non-executable memory protections
It's surprising to note that FreeBSD didn't implement ASLR by default, despite it being a standard security feature in Linux since kernel 2.6. While ASLR isn't perfect and can be defeated in certain circumstances, it provides an important security layer that significantly raises the bar for attackers.
Documentation and Resources
Hardened BSD provides documentation that builds upon the FreeBSD handbook with additional security-specific chapters. The documentation explains how to implement various security features like page execution protection and SafeStack.
Their approach demonstrates a fundamental security principle: security should be implemented in layers. Even if one security measure can be circumvented, additional layers provide further protection. It's similar to having a door on your house - while someone could potentially kick it down, it still serves as a deterrent and basic protection for most situations.
Project Status and Team
The core team behind Hardened BSD is relatively small, primarily driven by Shawn Webb and Oliver Pinter, with contributions from a handful of additional developers. Despite the small team size, they maintain an active development pace - at the time of recording, the ports were updated just 22 minutes prior!
The project's roadmap (though slightly outdated in the video) includes plans for network installation media, package mirrors, and potentially a SecADM implementation. They maintain their own FreeBSD package repository for FreeBSD 11, likely because packages need to be compiled with specific compiler flags to work with their security enhancements like ASLR.
Installation Experience
Installing Hardened BSD is similar to installing FreeBSD, but with additional security-focused options. The installation process includes options for enabling various security features:
- Hiding processes running as other users or groups
- Disabling kernel message buffer reading for unprivileged users
- Disabling process debugging facilities for unprivileged users
- Inserting stack guard pages
- Cleaning the /tmp filesystem on system startup
- Disabling remote logging
- Disabling sendmail service
These options allow you to harden your system right from installation, providing security by default rather than requiring post-installation configuration.
Conclusion
Hardened BSD represents an interesting evolution in the BSD ecosystem, focusing specifically on security enhancements that might otherwise take years to implement in the main FreeBSD project. For those who prioritize security in their BSD deployments, it offers a compelling alternative that maintains FreeBSD compatibility while adding multiple layers of security protections.
While the project is maintained by a small team, their commitment to regular updates and security enhancements makes Hardened BSD worth considering for security-conscious users and organizations.
---
*This article was adapted from an episode of BSD Synergy hosted by Mason Egger.
Link:
Comments
Post a Comment