Page MenuHomeFreeBSD
Files F115802489

D40142.diff
No OneTemporary
Actions

D40142.diff
View Options

diff --git a/usr.sbin/bsdinstall/scripts/Makefile b/usr.sbin/bsdinstall/scripts/Makefile
--- a/usr.sbin/bsdinstall/scripts/Makefile
+++ b/usr.sbin/bsdinstall/scripts/Makefile
@@ -8,7 +8,6 @@
docsinstall \
entropy \
fetchmissingdists \
- hardening \
hostname \
jail \
keymap \
diff --git a/usr.sbin/bsdinstall/scripts/auto b/usr.sbin/bsdinstall/scripts/auto
--- a/usr.sbin/bsdinstall/scripts/auto
+++ b/usr.sbin/bsdinstall/scripts/auto
@@ -364,7 +364,6 @@
fi
[ -z "$BSDINSTALL_SKIP_TIME" ] && bsdinstall time
[ -z "$BSDINSTALL_SKIP_SERVICES" ] && bsdinstall services
-[ -z "$BSDINSTALL_SKIP_HARDENING" ] && bsdinstall hardening
[ -z "$BSDINSTALL_SKIP_USERS" ] && dialog --backtitle "$OSNAME Installer" \
--title "Add User Accounts" --yesno \
@@ -382,7 +381,6 @@
"Hostname" "Set system hostname" \
"Network" "Networking configuration" \
"Services" "Set daemons to run on startup" \
- "System Hardening" "Set security options" \
"Time Zone" "Set system timezone" \
"Handbook" "Install $OSNAME Handbook (requires network)" 2>&1 1>&3)
exec 3>&-
@@ -408,10 +406,6 @@
bsdinstall services
finalconfig
;;
- "System Hardening")
- bsdinstall hardening
- finalconfig
- ;;
"Time Zone")
bsdinstall time
finalconfig
diff --git a/usr.sbin/bsdinstall/scripts/config b/usr.sbin/bsdinstall/scripts/config
--- a/usr.sbin/bsdinstall/scripts/config
+++ b/usr.sbin/bsdinstall/scripts/config
@@ -35,11 +35,6 @@
cat $BSDINSTALL_CHROOT/etc/sysctl.conf $BSDINSTALL_TMPETC/sysctl.conf.* >> $BSDINSTALL_TMPETC/sysctl.conf
rm $BSDINSTALL_TMPETC/sysctl.conf.*
-if [ -f $BSDINSTALL_TMPETC/ttys.hardening ]; then
- cat $BSDINSTALL_TMPETC/ttys.hardening > $BSDINSTALL_TMPETC/ttys
- rm $BSDINSTALL_TMPETC/ttys.hardening
-fi
-
cp $BSDINSTALL_TMPETC/* $BSDINSTALL_CHROOT/etc
cat $BSDINSTALL_TMPBOOT/loader.conf.* >> $BSDINSTALL_TMPBOOT/loader.conf
diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening
deleted file mode 100755
--- a/usr.sbin/bsdinstall/scripts/hardening
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/bin/sh
-#-
-# Copyright (c) 2016 Bartek Rutkowski
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 1. Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-# 2. Redistributions in binary form must reproduce the above copyright
-# notice, this list of conditions and the following disclaimer in the
-# documentation and/or other materials provided with the distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-# SUCH DAMAGE.
-#
-# $FreeBSD$
-
-BSDCFG_SHARE="/usr/share/bsdconfig"
-. $BSDCFG_SHARE/common.subr || exit 1
-
-: ${BSDDIALOG_OK=0}
-
-echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening
-echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening
-echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening
-
-exec 3>&1
-FEATURES=$( bsddialog --backtitle "$OSNAME Installer" \
- --title "System Hardening" --nocancel --separate-output \
- --checklist "Choose system security hardening options:" \
- 0 0 0 \
- "0 hide_uids" "Hide processes running as other users" ${hide_uids:-off} \
- "1 hide_gids" "Hide processes running as other groups" ${hide_gids:-off} \
- "2 hide_jail" "Hide processes running in jails" ${hide_jail:-off} \
- "3 read_msgbuf" "Disable reading kernel message buffer for unprivileged users" ${read_msgbuf:-off} \
- "4 proc_debug" "Disable process debugging facilities for unprivileged users" ${proc_debug:-off} \
- "5 random_pid" "Randomize the PID of newly created processes" ${random_pid:-off} \
- "6 clear_tmp" "Clean the /tmp filesystem on system startup" ${clear_tmp:-off} \
- "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \
- "8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \
- "9 secure_console" "Enable console password prompt" ${secure_console:-off} \
- "10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \
-2>&1 1>&3 )
-retval=$?
-exec 3>&-
-
-if [ $retval -ne $BSDDIALOG_OK ]; then
- exit 1
-fi
-
-for feature in $FEATURES; do
- case "$feature" in
- hide_uids)
- echo security.bsd.see_other_uids=0 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- hide_gids)
- echo security.bsd.see_other_gids=0 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- hide_jail)
- echo security.bsd.see_jail_proc=0 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- read_msgbuf)
- echo security.bsd.unprivileged_read_msgbuf=0 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- proc_debug)
- echo security.bsd.unprivileged_proc_debug=0 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- random_pid)
- echo kern.randompid=1 >> $BSDINSTALL_TMPETC/sysctl.conf.hardening
- ;;
- clear_tmp)
- echo 'clear_tmp_enable="YES"' >> $BSDINSTALL_TMPETC/rc.conf.hardening
- ;;
- disable_syslogd)
- echo 'syslogd_flags="-ss"' >> $BSDINSTALL_TMPETC/rc.conf.hardening
- ;;
- disable_sendmail)
- echo 'sendmail_enable="NONE"' >> $BSDINSTALL_TMPETC/rc.conf.hardening
- ;;
- secure_console)
- sed "s/unknown off secure/unknown off insecure/g" $BSDINSTALL_CHROOT/etc/ttys > $BSDINSTALL_TMPETC/ttys.hardening
- ;;
- disable_ddtrace)
- echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
- ;;
- esac
-done

File Metadata

Mime Type
text/plain
Expires
Tue, Apr 29, 9:13 PM (6 h, 20 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
17846409
Default Alt Text
D40142.diff (6 KB)

Event Timeline