TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

OpenBSD Workstation Hardening

149 点作者 upofadown超过 1 年前

12 条评论

rollcat超过 1 年前
So there&#x27;s one idea that sent me thinking: that actually sounds reasonable, even if inconvenient - remove self from wheel&#x2F;doas&#x2F;sudo, and switch VTs to escalate privileges. The reason why this is more secure is because no software running as an unprivileged user could simulate the physical keystrokes necessary for the VT switch. But why does it have to be so inconvenient, what if we could eat the cake and have it too? Maybe just require pressing a certain key combo on the physical keyboard whenever prompted for a password by su&#x2F;doas&#x2F;sudo?<p>Then I remembered! Windows NT did exactly that: you had to press ctrl+alt+del to log in.
评论 #38858167 未加载
_joel超过 1 年前
How come every ssh connection goes via a proxy user? Isn&#x27;t that masking the accounting? Or am I misreading it?<p><a href="https:&#x2F;&#x2F;dataswamp.org&#x2F;~solene&#x2F;2023-12-31-hardened-openbsd-workstation.html#_SSH" rel="nofollow">https:&#x2F;&#x2F;dataswamp.org&#x2F;~solene&#x2F;2023-12-31-hardened-openbsd-wo...</a><p>edit: oh, it&#x27;s for outbound ssh, but I&#x27;m still none the wiser in terms of auditing (or what that would do to git clones without some modification)
hpeter超过 1 年前
&quot;The OpenBSD malloc system allows you to enable some extra checks, like use after free, heap overflow or guard pages...&quot;<p>How would the added protection compare to safety in rust?<p>Wouldn&#x27;t it be useful to develop C on a memory hardened system, then deploy anywhere knowing there were checks during development? Would that help avoid the memory issues later in production?
评论 #38858062 未加载
groundthrower超过 1 年前
Why do we always have hardening guides? Ain’t there any OS where an easening&#x2F;loosening guide is needed instead?
评论 #38858811 未加载
评论 #38858629 未加载
评论 #38858608 未加载
评论 #38858416 未加载
comprev超过 1 年前
That sort of hardened environment is what I would expect the sysadmins&#x2F;operators of the darknet marketplaces to run.<p>Home directories in memory, proxied outbound SSH connections, high levels of encryption and absolute minimum installed software to do the job required.<p>The consequences of OpSec failure is.... well, rather serious :)
评论 #38856991 未加载
评论 #38856270 未加载
评论 #38854201 未加载
评论 #38855713 未加载
评论 #38856174 未加载
znpy超过 1 年前
wasn&#x27;t OpenBSD be supposed to be, and i quote, &quot;secure by default&quot; ?
评论 #38855790 未加载
评论 #38861988 未加载
PrimeMcFly超过 1 年前
Honestly just setup SELinux on Alpine or Void, and that&#x27;s going to be a much more secure workstation already.
UniverseHacker超过 1 年前
Don&#x27;t forget the most important security considerations: (1) choose a hardware and OS combination where none of your I&#x2F;O hardware (video, audio, wifi, etc.) is supported, so that it can never be used to exploit your system; (2) choose an OS so obscure and weird that a potential hacker is guaranteed to have never even heard of it, and would need to study your specific machine for months to make heads or tails of it<p>Just joking, I love OpenBSD
评论 #38856788 未加载
评论 #38858827 未加载
评论 #38856953 未加载
SoftTalker超过 1 年前
One thing I&#x27;ve encountered working with OpenBSD is: change the defaults at your peril. The base system is intended to work and be secure as-is. If you start &quot;hardening&quot; it, expect odd breakage here and there and you will get little sympathy or help from the email lists.
评论 #38856513 未加载
评论 #38856959 未加载
gigatexal超过 1 年前
Oh man this is hella paranoid security porn ring on a kink. Disabling networking for your user? Come on.
justsomehnguy超过 1 年前
By running OpenBSD as a workstation you already made sure what 99% wouldn&#x27;t connect with you &#x2F;redditmode<p>This guide is partly Security 101, partly for a localhost admin. Things are different when you run an organization with a centrally managed catalogue. Or you are sane and have a clear picture of the attack vectors.<p>Least privilege? Yes, of course.<p>Drop inbound by default? Yes, <i>of course</i> and it&#x27;s amazing how many self-titled Linux Administrators insist what the machine should be &#x27;secure from start so no firewall is needed&#x27;. Also this guide implies a workspace which questions what exactly kind of malicious traffic a [single] OpenBSD machine in the network would receive.<p>Drop outbound by default? Yes and BTW it&#x27;s pretty easy on Windows, because the <i>Windows Defender Firewall</i> (what a mouthful) is pretty capable to filter by an application, not just by IPs and ports, so you don&#x27;t need this SOCKS ersatz app firewall.<p>&gt; Live in a temporary file-system<p>Now this is just ridiculous. As other said this is Silk Road level of paranoia.<p>&gt; Disable webcam and microphone<p>Don&#x27;t connect them in the first place?<p>&gt; Disabling USB ports<p>See the temporary file-system. Good luck finding a notebook with PS&#x2F;2 <i>or serial</i> ports.<p>&gt; auto-updating the packages and base system daily on a computer is the minimum that should be done everywhere<p>Oh god.<p>&gt; 10.1. Specialized proxies §<p>&gt; It could be possible to have different proxy users, with each restriction to the remote ports allowed, we could imagine proxies like<p>&gt; Of course, this is even more tedious than the multipurpose proxy, but at least, it&#x27;s harder for a program to guess what proxy to use, especially if you don&#x27;t connect them all at once.<p>Now this is what bugs me most of this guide.<p>If you already allowed something to run on your machine then it is usually too late for security through obscurity exercises. Most of the things advised here would just make your life miserable and would lead to disabling or shortcutting them.
评论 #38857847 未加载
评论 #38856762 未加载
评论 #38856811 未加载
评论 #38856406 未加载
tedunangst超过 1 年前
Presented with the opportunity to learn more about how a system works, the HN cries, no, I hate learning.
评论 #38857976 未加载