Basic FreeBSD Server Setup

/etc/rc.conf set potentially a huge number of options, most systems and situation specific but I always set the two options below.

I get slightly annoyed by the default log format which starts with a month name as opposed to 'yyyy-mm-dd' format, which makes it much easier to search and sort, plus I don't want syslog(8) unnecessarily opening ports, these options are covered by:

syslogd_flags="-ss -O syslog"

Additionally it's good hygiene to make sure that there's not lots of old stuff lying around int /tmp, so add

clear_tmp_enable="YES"

to clear the temporary filesystem on startup.

There are plenty of tutorials explaining how to safely set up SSH. This is the very short version. Assuming that sshd is already running, and your machine was set up to allow connecting with a password, we want to change it so only keys are used and there's no root login. We'll also change the SSH port. Like using a less used username above, this doesn't really do much to enhance security, but it does make you less vulnerable to the laziest class of attacks, and stops filling up your logfiles.

Warning
When changing you SSH settings and connections, always test with a new session, and keep an existing session open. That way, if you can't connect from the new session because of some mis-configuration, you can use the pre-existing connection to fix your mistake. Otherwise you can lock yourself out.

Create a SSH key with ssh-keygen(1) on your local machine, which we'll assume is stored as ~/.ssh/id_ed25519.pub. Then:

$ ssh-copy-id -i ~/.ssh/id_ed25519.pub <username>@<server IP address>

Then add the following to ~/.ssh/config, which saves lots of typing in the future.

Host <name>
        Hostname <your IP address>
        User <admin user>
        UserKnownHostsFile ~/.ssh/known_hosts
        IdentityFile ~/.ssh/id_ed25519

Attempt to connect with ssh <name>, which will hopefully work.

There are a few edits we can make to the /etc/ssh/sshd_config, which apart from changing the port number, which mean you can only log in with a key, and couple of other tweaks.

• 'Port': Change the port number. Pick a random high port number that doesn't clash with any service you might actually want to run on the server. perhaps check this list first.
• 'PasswordAuthentication no': This is the default and so should already be set, but means you can just connect with a password
• 'KbdInteractiveAuthentication no': This means you can't connect with interactively typing a password. (This can be confusing as it's easy to think the previous option prevents this as well, but it doesn't.)
• 'UsePAM no': Unless you're actually using PAM for authentication, and which point you're well beyond anything my notes here are going to tell you.
• 'VersionAddendum none': No need to expose unnecessary host information.
• 'Subsystem no': this is the default, but I've seen a number of default sshd_config files where this is then re-activated, typically with sftp. Unless you're actually intending on running sftp, or another service, you can also remove that.

port <new ssh port number>
KbdInteractiveAuthentication no
PasswordAuthentication no
UsePAM no
VersionAddendum none
Subsystem no  #  Remove existing Subsystem setting if present

Depending on where you got your VPS from, you might find other options at the very end of the config file and not just the uncommented default higher up the file. The last version of the setting that appears in the file is the one that's used, so check to the end.

These changes won't take effect until you restart the SSH demon. Your existing connection will remain, do not disconnect until you've tested the changes from a new terminal and you can make sure you can get back in.

Then restart sshd

# service sshd restart

You should be able to see the port sshd is using now with

$ sockstat | grep 'sshd '

Then update your .ssh/config file to add the port <new ssh port number> line in, then in a new terminal (leaving the previous one connected) try connecting. If that doesn't work, then check the above options.

I prefer doas(1) to sudo mostly because the configuration file is much easier to understand, and it's smaller and simpler. Sudo can do much more, but I don't need more. Add your admin user into the configuration file with:

# echo "permit nopass <adminuser>" > /usr/local/etc/doas.conf

That should cut down on the amount of time logged in as the root user.

You want to make sure you're running on the right time. But first make sure you aren't running the service in /etc/ntp.conf that others can connect to, so make sure the first two lines are commented, and the last one is uncommented (done with a #)

# restrict default limited kod nomodify notrap noquery nopeer
# restrict source  limited kod nomodify notrap noquery
restrict default ignore

Then run:

# service ntpd enable
# service ntpd start

It's useful to be able to send email from a machine, especially as the result of cron jobs that you have running. The FreeBSD handbook has suitable steps, but the short version is; in /etc/dma/dma.conf:

SMARTHOST <your smtp address>
PORT 465
AUTHPATH /etc/dma/auth.conf
SECURETRANSFER
MAILNAME <yourdomain>

and then add the authentication (normally an app password) into /etc/dma/auth.conf. (This is your email provider's details, not those of the local account on the host. That's set in the dma.conf file.)

Then test with:

$ echo "Hello World!" | mail -v -s testing-email to-mail@example.com

The sending user will the the logged in user, from the domain set after MAILNAME in dma.conf.

By default the swap space on a FreeBSD system isn't encrypted, that means sensitive information can be left lying around there. (This is admitidly a slightly odd default that most other OS have been doing for a while.)

For that we can use the built-in geli(8) encryption utility. Before making the other changes, make sure this is loaded by your kernal if it's not compiled in, so add:

geom_eli_load="YES"

into /boot/loader.conf so that it's loaded on start up.

Luckily setting it up is very simple. Add .eli onto the end of the swap partition in /etc/fstab to encrypt the swap partition starting on next boot, so now it reads:

# Device                Mountpoint      FStype  Options         Dump    Pass#
/dev/<your partition>.eli         none    swap    sw              0       0

Since this is a new system there's probably not a lot in swap, but if you've been running it a while, it might be worth cleaning out in case there's anything in the partition before it was encrypted. You can check the state of the swap space with swapinfo. If it's not currently empty, shut down some applications and re-start the system.

If you swap is currently unused, then you can run:

# dd if=/dev/random of=/dev/<your partition> bs=1m

To fill it with random nonsense.

Then when you restart the machine, data written to swap shouldn't be readable to anyone else.

There are a lot of system control parameters you can adjust, literally thousands. These are the ones I think help to 'harden' the OS a bit perhaps at the expense of some convenience or performance. Which balance is right for you depends on your situation.

You can check the current value of each with sysctl <sysctl name, or part name>. Adding the -d will give you a description. Depending on how FreeBSD was set up (e.g. version, install image or options chosen during the installer process) some of these may already be set to the values below. Setting them again won't do any harm if it's already the default value.

# Prevent unprivileged processes seeing subjects/objects with different real user ids
security.bsd.see_other_uids=0
# Prevent unprivileged processes seeing subjects/objects with different real group ids
security.bsd.see_other_gids=0
# Prevent unprivileged processes reading the kernal message buffer
security.bsd.unprivileged_read_msgbuf=0
# Prevent unprivileged processes from using the debugging facilities  
security.bsd.unprivileged_proc_debug=0
# Add guard pages to growing memory stacks   
security.bsd.stack_guard_page=1
# Prevent unprivileged processes from creating hard links to files owned by other groups
# (this and one below can apparently
# interfere with poudriere builds, if you use that for building ports)
security.bsd.hardlink_check_gid=1
# Prevent unprivileged processes from creating hard linkts to files owned by other users
security.bsd.hardlink_check_uid=1 
# Prevent unpriviliged processes from seeing subjects/objects with different jail ids.
security.bsd.see_jail_proc=0
# Choose a random PID for processes  
kern.randompid=1
# Prevent core dumps from set-uid/gid programs
kern.sugid_coredump=0
# Enable locking of shared memory pages in core
kern.ipc.shm_use_phys=1
# Enable kernel ASLR (address space layout randomisation)
# and related
kern.elf64.aslr.enable=1
kern.elf64.aslr.pie_enable=1
kern.elf64.aslr.stack=1
# ...again for 32 bit programs
kern.elf32.aslr.enable=1
kern.elf32.aslr.pie_enable=1
kern.elf32.aslr.stack=1

These will then be set on restart, or you can trigger the change straight away with:

# service sysctl restart

Additionally some settings for network behaviour. In some cases this can make network debugging trickier, so perhaps only change them once you're happy with the setup.

# Ignore ICMP redirects
net.inet.icmp.drop_redirect=1
# Log ICMP redirects to the console
net.inet.icmp.log_redirect=1
# Disable sending IP redirects
net.inet.ip.redirect=0
# Don't send ICMPv6 redirects for unforwardable IPv6 packets
net.inet6.ip6.redirect=0
# Don't reply to multicast ICMP Echo Request and Timestamp packets
net.inet.icmp.bmcastecho=0
# Disable forwarding source routed IP packets
net.inet.ip.sourceroute=0
# Disable accepting source routed IP packets
net.inet.ip.accept_sourceroute=0
# Do not send RST on segments to closed ports
net.inet.tcp.blackhole=2
# Do not send port unreachables for refused connects
net.inet.udp.blackhole=1

The following can be set in /boot/loader.conf, to be set earlier in the boot process that those in syctl.conf. Some that can be useful to set there are:

# Minimum pool size necessary to cause a reseed
kern.random.fortuna.minpoolsize=128
# Disable hyperthreading, if this reduces performance depends
# on the tasks being done.
machdep.hyperthreading_allowed=0
# Flush L1D on syscall return with error (0 - off, 1 - on, 2 - use hw only, 3 - use sw only)
machdep.syscall_ret_flush_l1d=1
# Speculative Store Bypass Disable (0 - off, 1 - on, 2 - auto)
hw.spec_store_bypass_disable=1
# Microarchitectural Data Sampling Mitigation (0 - off, 1 - on VERW, 2 - on SW, 3 - on AUTO)
hw.mds_disable=3

• 2026-04-19: Added sysctl options and swap encryption in 'Additional' section, plus added a couple more SSH options.