Post-installation Setup and Configuration

Post-installation Setup and Configuration

By | | Comments 0 Comment

Last Updated on 2020-12-29 by Sture

This page was last modified [last-modified]

First login

As the FreeBSD server boots, informational messages are displayed on the screen and after the system finishes booting, a login prompt is displayed as in this example:

FreeBSD/amd64 (srv.local) (ttyv0)

login:

Login as user root with the password you entered during the installation:

login: root [enter]
Password: <-- password [enter]

Display current Network settings

Display the current active Network Interface settings with:

$ ifconfig -u [enter]
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=81249b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LRO,WOL_MAGIC,VLAN_HWFILTER>
	ether 00:23:24:ba:1a:1b
	inet 192.168.1.21 netmask 0xffffff00 broadcast 192.168.1.255
	media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
	inet 127.0.0.1 netmask 0xff000000
	groups: lo
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
$

In this example, Network Interface Controller, NIC, em0 has been found and it has been configured to have IP Address 192.168.1.21.

Remote login

To make life easier and permit you to copy commands from this web page go to another computer connected to the same local network as your FreeBSD server.

Start for example PuTTY on a Windows PC, Terminal on a Mac or a similar application on a Linux PC. In this example Terminal on a Mac is used.

Mac:~ user$ ssh user@192.168.1.21 [enter]

N.B.: The use of an SSH client is highly recommended for logging into the remote FreeBSD server!

ssh (SSH client) is a program for logging into a remote machine and for executing commands on a remote machine. It is intended to provide secure encrypted communications between two untrusted hosts over an insecure network.

N.B.: If an ssh login has been performed before to the selected IP Address a warning – in this example on an iMac – will be displayed:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:.....
Please contact your system administrator.
Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/user/.ssh/known_hosts:1
ECDSA host key for 192.168.1.21 has changed and you have requested strict checking.
Host key verification failed.
user@Users-iMac ~ %

On a Mac, use the following steps to get access to the hidden file known_hosts:

  1. Select and Copy the file name in the warning messag, in this example: /Users/user/.ssh/known_hosts
  2. Click on the Finder icon and verify that Finder is displayed next to the Apple icon
  3. Click on Go and then Go to folder…
  4. Click in the Go to the folder: field, past file name into it and then click button Go

A Finder window with file known_hosts should now be displayed on the screen.

Dubble-click known_hosts to open the file in TextEdit. Delete the offending line, save the file, quit TextEdit, and finally repeat the login command above.

The authenticity of host 'srv.local (192.168.1.21)' can't be established.
ECDSA key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes [enter]
Warning: Permanently added 'srv.local' (ECDSA) to the list of known hosts.
Password for user@srv.local: <-- passwd [enter]
FreeBSD 12.2-RELEASE r366954 GENERIC 

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories:   https://www.FreeBSD.org/security/
FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
FreeBSD FAQ:           https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums:        https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with:  pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed:  freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages:  man man
FreeBSD directory layout:      man hier

Edit /etc/motd to change this login announcement.
If you have a CD-ROM drive in your machine, you can make the CD-ROM that is
presently inserted available by typing 'mount /cdrom' as root.  The CD-ROM
will be available under /cdrom/.  Remember to do 'umount /cdrom' before
removing the CD-ROM (it will usually not be possible to remove the CD-ROM
without doing this.)

Note: This tip may not work in all configurations.
user@server:~ $

sudo

The best practice is to never log in as the root superuser interactively. If you do – you are doing it wrong!

sudo is a program that allows a permitted user to execute a command as the superuser or another user, as specified by the user’s security policy. Unlike the su utility, sudo authenticates the user against the user’s own password rather than that of the target user. Sudo allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. This allows the delegation of specific commands to specific users on specific systems without sharing passwords among the users.

Installation

Installation and configuration of sudo requires superuser privileges. This sudo installation will be the only and last interactive login as the root superuser you will ever need to perform on this system.

Substitute User identity to the root superuser identity with:

user@server:~ $ su -
Password: <-- passwd [enter]
root@server:~ #

Install sudo with:

root@server:~ # pkg install sudo [enter]
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y [enter]
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly, please wait...
Verifying signature with trusted certificate pkg.freebsd.org.2013102301... done
Installing pkg-1.15.10...
Extracting pkg-1.15.10: 100%
Updating FreeBSD repository catalogue...
Fetching meta.conf: 100%    163 B   0.2kB/s    00:01    
Fetching packagesite.txz: 100%    6 MiB   1.1MB/s    00:06    
Processing entries: 100%
FreeBSD repository update completed. 31737 packages processed.
All repositories are up to date.
Updating database digests format: 100%
The following 3 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	gettext-runtime: 0.21
	indexinfo: 0.3.1
	sudo: 1.9.3p1

Number of packages to be installed: 3

The process will require 5 MiB more space.
1 MiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
[1/3] Fetching sudo-1.9.3p1.txz: 100%  925 KiB 473.4kB/s    00:02    
[2/3] Fetching gettext-runtime-0.21.txz: 100%  165 KiB 168.9kB/s    00:01    
[3/3] Fetching indexinfo-0.3.1.txz: 100%    6 KiB   5.8kB/s    00:01    
Checking integrity... done (0 conflicting)
[1/3] Installing indexinfo-0.3.1...
[1/3] Extracting indexinfo-0.3.1: 100%
[2/3] Installing gettext-runtime-0.21...
[2/3] Extracting gettext-runtime-0.21: 100%
[3/3] Installing sudo-1.9.3p1...
[3/3] Extracting sudo-1.9.3p1: 100%
root@server:~ #

Configuration

A default sudo configuration file /usr/local/etc/sudoers was created as part of the installation process.

N.B.: /usr/local/etc/sudoers MUST be edited with the visudo command as root.

The use of visudo minimizes the risk for syntax or file permission errors that prevents sudo from running.

Start editing file /usr/local/etc/sudoers with:

root@server:~ # visudo [enter]
## sudoers file.
##
## This file MUST be edited with the 'visudo' command as root.
## Failure to use 'visudo' may result in syntax or file permission errors
## that prevent sudo from running.
##
## See the sudoers man page for the details on how to write a sudoers file.
##
.
.
.

visudo use the famous vi editor commands. The following commands is needed for updating and saving or exit without saving file /usr/local/etc/sudoers:

  1. Use the arrow keys to move the cursor or…
  2. Move the cursor up one line with key ‘K’, down one line with key ‘J’, left one character with key ‘H’ and right one character with key ‘L’
  3. Press key ‘I’ to start inserting charters before the current cursor location
  4. Press key ‘A’ to start inserting charters after the current cursor location
  5. Press key ‘esc’ to abort inserting charters
  6. Press key ‘X’ to delete the character under the cursor
  7. Press key ‘:’, then ‘W’ and ‘Q’ to save and exit
  8. Press key ‘:’, then ‘Q’ and ‘!’ to exit without saving

To delegate privileges to the example user user locate section User privilege specification in the file /usr/local/etc/sudoers.

To allow user user to execute any command via sudo add the following text:

##
## User privilege specification
##
root ALL=(ALL) ALL
user ALL=(ALL) ALL

…or to allow user user as a members of group wheel to execute any command via sudo uncomment – delete the ‘#’ character. The line should look like this:

## Uncomment to allow members of group wheel to execute any command
%wheel ALL=(ALL) ALL

Finally exit the root superuser identity with:

root@server:~ # exit [enter]
logout
$

Date and Time

Enable superuser privileges with:

$ sudo -s [enter]

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

Password: <-- passwd [enter]
#

Stop the ntpd daemon program if it is running with:

# service ntpd stop [enter]
Stopping ntpd.
Waiting for PIDS: 647.
#

Set the date and time via NTP, using this command:

# ntpdate -v -b pool.ntp.org [enter]
14 Feb 14:11:07 ntpdate[831]: ntpdate 4.2.8p8-a (1)
14 Feb 14:11:15 ntpdate[831]: step time server 79.138.40.123 offset 0.001542 sec
#

N.B.: The ntp server “pool.ntp.org” is recommended by ntp.org. You can also select another one, check out http://www.ntp.org for details.

Defaults

List defaults for ntpd with:

# cat /etc/defaults/rc.conf | grep ntpd_ [enter]
ntpd_enable="NO" # Run ntpd Network Time Protocol (or NO).
ntpd_program="/usr/sbin/ntpd" # path to ntpd, if you want a different one.
ntpd_config="/etc/ntp.conf" # ntpd(8) configuration file
ntpd_sync_on_start="NO" # Sync time on ntpd startup, even if offset is high
ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntpd.drift" # Flags to ntpd (if enabled).
#

Enable NTPd

To ensure the NTP server is started at boot time verify that line ntpd_enable=”YES” to has been added to file /etc/rc.conf with:

# echo '' >> /etc/rc.conf; echo '# Network Time Protocol' >> /etc/rc.conf [enter]
# echo 'ntpd_enable="YES"' >> /etc/rc.conf [enter]
# echo 'ntpd_sync_on_start="YES"' >> /etc/rc.conf [enter]
# echo 'ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntpd.drift -g"' >> /etc/rc.conf [enter]
#

If ntpd daemon program was running and stoped without any warnings or error above, then you should edit file /etc/rc.conf with:

# ee /etc/rc.conf [enter]

…and delete line ntpd_enable=”YES” above line # Network Time Protocol.

Configure NTPd

The /etc/ntp.conf configuration file is read at initial startup by the ntpd(8) daemon in order to specify the synchronization sources, modes and other related information.

Specify the NTP synchronization sources your server will use with:

# ee /etc/ntp.conf [enter]

The following three servers will give you a random set of three NTP servers geographically close to you:

##
# ntpd.conf
#
server 0.freebsd.pool.ntp.org iburst
server 1.freebsd.pool.ntp.org iburst
server 2.freebsd.pool.ntp.org iburst

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict -6 ::1
restrict 127.127.1.0

leapfile "/etc/ntp/leap-seconds"

See http://www.pool.ntp.org/ for details.

Example: Sweden — se.pool.ntp.org:

#
# ntpd.conf
#
server 0.se.pool.ntp.org iburst
server 1.se.pool.ntp.org iburst
server 2.se.pool.ntp.org iburst
server 3.se.pool.ntp.org iburst

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict -6 ::1
restrict 127.127.1.0

leapfile "/etc/ntp/leap-seconds"

The driftfile is by default /var/db/ntpd.drift.

Manually start NTPd

Start Network Time Protocol (NTP) daemon, using this command:

# service ntpd start [enter]
Starting ntpd.
#

NTP is a very cautious standard. It will report its stratum to 16 (the worst possible) until it’s sure that its in sync. This can take a few minutes to few hours.

Standard NTP query program

The ntpq utility is used to monitor NTP daemon ntpd operations and determine performance.

Print a list of the peers known to the server as well as a summary of their state:

# ntpq -pn localhost [enter]
remote refid st t when poll reach delay offset jitter
==============================================================================
-188.126.88.9 192.36.144.22 2 u 22 64 1 20.184 1.962 3.454
*192.36.143.130 .PPS. 1 u 26 64 3 18.953 8.415 27.720
+194.71.144.71 192.36.144.22 2 u 31 64 3 32.755 8.158 28.261
+83.168.200.199 192.36.143.154 2 u 28 64 3 15.500 7.787 27.919
#

N.B.: Waiting for “st” to drop to 2 (since those should be stratum 2 servers) before the server is used for time sync of local computers.

Documentation

Documentation in HTML format for the NTP server can be found in: /usr/share/doc/ntp/.

Base System Binary Update

The freebsd-update tool is used to fetch, install, and rollback binary updates to the FreeBSD base system.

Fetch

Fetch files necessary for upgrading to a new release with:

# freebsd-update fetch < enter>
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching public key from update6.freebsd.org... done.
Fetching metadata signature for 11.0-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Fetching 2 metadata files... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 171 patches.....10....20....30....40....50....60....70....80....90....100....110....120....130....140....150....160....170 done.
Applying patches... done.
Fetching 6 files... done.
--More--(END)

Press key ‘Q’ to skip displaying the list of fetched files.

The following files will be removed as part of updating to 11.0-RELEASE-p7:
/usr/share/zoneinfo/America/Santa_Isabel
/usr/share/zoneinfo/Asia/Rangoon
--More--(END)

Press ‘space’ key to displaying a list of files that will be added.

The following files will be added as part of updating to 11.0-RELEASE-p7:
/usr/share/zoneinfo/Asia/Barnaul
/usr/share/zoneinfo/Asia/Famagusta
/usr/share/zoneinfo/Asia/Tomsk
/usr/share/zoneinfo/Asia/Yangon
/usr/share/zoneinfo/Europe/Astrakhan
/usr/share/zoneinfo/Europe/Kirov
/usr/share/zoneinfo/Europe/Ulyanovsk
--More--(END)

Press key ‘Q’ to skip displaying a list of files that will be updated.

#

Installation

The binary updates is installed with:

# freebsd-update install [enter]
src component not installed, skipped
Installing updates... done.
#

BASH – Bourne Again SHell

Bash is the GNU Project’s Bourne Again SHell, a complete implementation of the POSIX.2 shell spec, but also with interactive command line editing, job control on architectures that support it, csh-like features such as history substitution and brace expansion, and a slew of other features.

WWW: http://cnswww.cns.cwru.edu/~chet/bash/bashtop.html

Installation

Install bash with:

# pkg install bash [enter]
Updating FreeBSD repository catalogue...
Fetching meta.txz: 100% 944 B 0.9kB/s 00:01
Fetching packagesite.txz: 100% 6 MiB 2.0MB/s 00:03
Processing entries: 100%
FreeBSD repository update completed. 25860 packages processed.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
bash: 4.4.12

Number of packages to be installed: 1

The process will require 8 MiB more space.
1 MiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching bash-4.4.12.txz: 100% 1 MiB 730.5kB/s 00:02
Checking integrity... done (0 conflicting)
[1/1] Installing bash-4.4.12...
[1/1] Extracting bash-4.4.12: 100%
Message from bash-4.4.12:
======================================================================

bash requires fdescfs(5) mounted on /dev/fd

If you have not done it yet, please do the following:

mount -t fdescfs fdesc /dev/fd

To make it permanent, you need the following lines in /etc/fstab:

fdesc /dev/fd fdescfs rw 0 0

======================================================================
#

Configuration

# mount -t fdescfs fdesc /dev/fd [enter]
#

Make this mount permanent with:

Start editing file /etc/fstab with;

# echo 'fdesc /dev/fd fdescfs rw 0 0' >> /etc/fstab
#

Change the current user’s shell setting to bash with:

# chsh -s /usr/local/bin/bash user [enter]
chsh: user information updated
# chsh -s /usr/local/bin/bash root [enter]
chsh: user information updated
#

Verify that bash is the default shell for user account user, with:

# cat /etc/passwd | grep user
.
.
.
user:*:1001:1001:Example User:/home/user:/usr/local/bin/bash
.
.
#

Verify that bash is the default shell for user account root, with:

# cat /etc/passwd | grep root
.
.
root:*:0:0:Charlie &:/root:/usr/local/bin/bash
.
.
#

Optional: Colorized ‘ls’ and ‘ll’ in BASH

Description

Enable ls color and add command ll with some color.

Configuration

Add two alias commands to file /etc/profile for all users with:

# echo "alias ll='ls -lGF'" >> /etc/profile; echo "alias ls='ls -GF'" >> /etc/profile [enter]
#

Revoke Privileges

Revoke superuser privileges with:

# exit [enter]
$

Log off your system with:

$ exit [enter]

Log Console Messages to File

Messages printed to the console during boot will pass by too fast to be read, or are too long to be copied.

Login to your system via a remote ssh session.

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
[root@server /usr/home/user]#

Enable all writes to /dev/console to be logged to file /var/log/console.log with:

[root@server /usr/home/user]# ee /etc/syslog.conf [enter]

…and then uncomment line 21 as in this example:

console.info /var/log/console.log

Create file /var/log/console.log with:

[root@server /usr/home/user]# touch /var/log/console.log [enter]
[root@server /usr/home/user]#

…and then change file modes to mode 600 with:

[root@server /usr/home/user]# chmod 600 /var/log/console.log [enter]
[root@server /usr/home/user]#

Restart syslogd to log all new console messages to file /var/log/console.log with:

[root@server /usr/home/user]# service syslogd restart [enter]
Stopping syslogd.
Waiting for PIDS: 808.
Starting syslogd.
[root@server /usr/home/user]#

A reboot is required to record all console messages on system boot. Reboot the system with:

[root@server /usr/home/user]# reboot [enter]

Wait for system to reboot and the log back in with a remote ssh client session.

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
[root@server /usr/home/user]#

Display file /var/log/console.log with:

[root@server /usr/home/user]# cat /var/log/console.log [enter]

…and look for ERRORs and WARNINGs as in this example:

.
.
Jan 14 15:51:11 server kernel: WARNING:
Jan 14 15:51:11 server kernel: New keymap: In /etc/rc.conf replace 'keymap=swedish.cp850.kbd' by 'keymap=se'.
.
.

If any errors and warnings is found, fix the problem and restart service syslogd as described above.

N.B.: The error displayed above has been fixed in the /etc/rc.conf example below!

Packet Filter (PF) Firewall

This PF setup is configured be very secure. All attempts to access the server via the network is blocked on all network ports with one critical exception; ssh clients on the local network using port 123 can access to allow for management of the headless server.

The example setup is designed to be used on a Headless Server with a single network interface card connected to a local network behind a firewall for internet access.

List LAN Network Card

List status up network interfaces with:

[root@server /usr/home/user]# ifconfig -u [enter]
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=4019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO>
ether xx:xx:xx:xx:xx:xx
inet 192.168.1.114 netmask 0xffffff00 broadcast 192.168.1.255
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: lo
[root@server /usr/home/user]#

In this example Network Interface Card em0 will be used.

Packet Filter (pf) Config File

Create file /etc/pf.conf with:

[root@server /usr/home/user]# ee /etc/pf.conf [enter]

…and copy this text to the file:

################ FreeBSD pf.conf ##########################################
# Required order: options, normalization, queueing, translation, filtering.
# Note: translation rules are first match while filter rules are last match.
################ Macros ####################################################

# Macros
lan_if="em0" # Local Network Interface Card

# Ports:
# 123 TCP Network Time Protocol

tcp_pass="{ 123 }"

# Tables

### Options
set block-policy return

### Normalization
scrub on $lan_if all random-id reassemble tcp fragment reassemble

### Queueing

### Translation

### Filtering

# Skip filtering on loopback
set skip on lo0

# Block traffic trying to get into the loopback interface from outside.
block quick from any to lo0:network

# Block all traffic in on LAN NIC by default
block in on $lan_if

# Pass specified traffic in to this server from LAN clients
pass in on $lan_if proto tcp from $lan_if:network to $lan_if port $tcp_pass

# Pass SSH traffic from LAN clients (for Admin)
pass in on $lan_if proto tcp from $lan_if:network to $lan_if port ssh

# Pass icmp (for ping) on LAN NIC
pass in on $lan_if proto icmp

# Pass all traffic out on LAN NIC by default
pass out on $lan_if proto { tcp, udp, icmp } all

N.B.: Update lan_if=”em0″ to match your systems LAN Internet Network Card ID!

Display the default packet filter (pf) and packet filter logging (pflog) settings with:

[root@server /usr/home/user]# cat /etc/defaults/rc.conf | grep -e "pf_\|pflog_" [enter]
pf_enable="NO" # Set to YES to enable packet filter (pf)
pf_rules="/etc/pf.conf" # rules definition file for pf
pf_program="/sbin/pfctl" # where the pfctl program lives
pf_flags="" # additional flags for pfctl
pflog_enable="NO" # Set to YES to enable packet filter logging
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_program="/sbin/pflogd" # where the pflogd program lives
pflog_flags="" # additional flags for pflogd
[root@server /usr/home/user]#

Service start on Boot

List installed pf services with:

[root@server /usr/home/user]# service -r | grep /pf [enter]
/etc/rc.d/pfsync
/etc/rc.d/pflog
/etc/rc.d/pf
[root@server /usr/home/user]#

Find the rcvar for /etc/rc.d/pf with:

[root@server /usr/home/user]# /etc/rc.d/pf rcvar [enter]
# pf : Packet filter
#
pf_enable="NO"
# (default: "")

[root@server /usr/home/user]#

..and for /etc/rc.d/pflog with:

[root@server /usr/home/user]# /etc/rc.d/pflog rcvar [enter]
# pf : Packet filter
#
pflog_enable="NO"
# (default: "")

[root@server /usr/home/user]#

Enable packet filter (pf) and packet filter logging (pflog) at boot with:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# Packet Filter (pf)' >> /etc/rc.conf; echo 'pf_enable="YES"' >> /etc/rc.conf; echo 'pflog_enable="YES"' >> /etc/rc.conf [enter]
[root@server /usr/home/user]#

Check /etc/pf.conf for errors, but do not load ruleset with:

[root@server /usr/home/user]# pfctl -vvnf /etc/pf.conf [enter]
int_if = "em0"
tcp_pass = "{ 123 }"
set block-policy return
set skip on { lo0 }
@0 scrub on em0 all random-id reassemble tcp fragment reassemble
@0 block return quick inet6 from any to ::1
@1 block return quick inet from any to 127.0.0.0/8
@2 block return in on em0 all
@3 pass in on em0 inet proto tcp from 192.168.1.0/24 to 192.168.1.5 port = ntp flags S/SA keep state
@4 pass in on em0 inet proto tcp from 192.168.1.0/24 to 192.168.1.5 port = netbios-ssn flags S/SA keep state
@5 pass in on em0 inet proto tcp from 192.168.1.0/24 to 192.168.1.5 port = microsoft-ds flags S/SA keep state
@6 pass in on em0 inet proto tcp from 192.168.1.0/24 to 192.168.1.5 port = ssh flags S/SA keep state
@7 pass in on em0 proto icmp all keep state
@8 pass out on em0 proto tcp all flags S/SA keep state
@9 pass out on em0 proto udp all keep state
@10 pass out on em0 proto icmp all keep state
[root@server /usr/home/user]#

Manually start the packet filter (pf) with:

[root@server /usr/home/user]# service pf start [enter]
Enabling pf

N.B.: This may disconnect the current ssh connections!

If you are disconnected, open a new remote ssh terminal session to the server and enable superuser privileges with:

[user@server ~]$ sudo -s
[root@server /usr/home/user]#

If everything is alright, then you will be able to verify the packet filter (pf) status with:

[root@server /usr/home/user]# service pf status [enter]
Status: Enabled for 0 days 00:13:15 Debug: Urgent

State Table Total Rate
current entries 1
searches 222 0.3/s
inserts 1 0.0/s
removals 0 0.0/s
Counters
match 79 0.1/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 14 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
map-failed 0 0.0/s
[root@server /usr/home/user]#

N.B.: Verify that the pf status is Enabled as in the example above.

Reload updates to /etc/pf.conf file with:

[root@server /usr/home/user]# service pf reload [enter]
[root@server /usr/home/user]#

…or load another file – in this example file /etc/pf.new – with:

[root@server /usr/home/user]# pfctl -vf /etc/pf.new [enter]
[root@server /usr/home/user]#

To see in real-time who is trying to connect to your server:

[root@server /usr/home/user]# tcpdump -n -e -ttt -i pflog0 [enter]
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 262144 bytes

When network activites is detected it will be listas as in this example:

00:00:00.000000 rule 28..16777216/0(match): block in on em0: 192.168.1.11.138 > 192.168.1.255.138: NBT UDP PACKET(138)
00:00:40.080628 rule 28..16777216/0(match): block in on em0: 192.168.1.11.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:25.057112 rule 28..16777216/0(match): block in on em0: 192.168.1.127.138 > 192.168.1.255.138: NBT UDP PACKET(138)
00:01:00.244084 rule 28..16777216/0(match): block in on em0: 192.168.1.10.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:13.685497 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:00.749718 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:00.096546 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:00.653724 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:00.093843 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
00:00:00.750227 rule 28..16777216/0(match): block in on em0: 192.168.1.124.137 > 192.168.1.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

Hit [ ctr ] and [ C ] to abort.

^C
10 packets captured
10 packets received by filter
0 packets dropped by kernel
[root@server /usr/home/user]#

In this example a HP LaserJet printer is broadcasting UDB packages, port 137 – ‘NetBIOS Name Service, used for name registration and resolution’ – and port 138 – ‘NetBIOS Datagram Service’.

Show history:

[root@server /usr/home/user]# tcpdump -n -e -ttt -r /var/log/pflog [enter]

And that’s it. You have successfully implemented PF firewall on your FreeBSD server!

Configuration Files

/etc/rc.conf

The file rc.conf contains descriptive information about the local host name, configuration details for any potential network interfaces and which services should be started up at system initial boot time. In new installations, the rc.conf file is generally initialized by the system installation utility.

[root@server /usr/home/user]# cat /etc/rc.conf [enter]

Example: When option < Yes >, use DHCP, was selected in the Network Configuration dialog.

clear_tmp_enable="YES"
sendmail_enable="NONE"
hostname="server.example.net"
keymap="se"
ifconfig_em0="DHCP"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"
zfs_enable="YES"
# ahci Advanced Host Controller Interface (AHCI)
# coretemp Device driver for Intel Core on-die digital thermal sensor
# i915kms Intel Graphics
kld_list="ahci coretemp i915kms"

# Network Time Protocol
ntpd_enable="YES"
ntpd_sync_on_start="YES"
ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntpd.drift -g"

# Packet Filter (pf)
pf_enable="YES"
pflog_enable="YES"

Example: When option < No >, use DHCP, was selected in the Network Configuration dialog.

clear_tmp_enable="YES"
sendmail_enable="NONE"
hostname="server.example.net"
keymap="se"
ifconfig_em0="inet 192.168.1.4 netmask 255.255.255.0"
defaultrouter="192.168.1.1"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"
zfs_enable="YES"

# Network Time Protocol
ntpd_enable="YES"
ntpd_sync_on_start="YES"
ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntpd.drift -g"

# ahci Advanced Host Controller Interface (AHCI)
# coretemp Device driver for Intel Core on-die digital thermal sensor
# i915kms Intel Graphics
kld_list="ahci coretemp i915kms"

# Packet Filter (pf)
pf_enable="YES"
pflog_enable="YES"

Information will be added as required by programs and services installed on the system.

The ifconfig_em0 entry in the example file above

/boot/loader.conf

The file loader.conf contains descriptive information on bootstrapping the system. Through it you can specify the kernel to be booted, parameters to be passed to it, and additional modules to be loaded; and generally set all variables described in loader(8).

[root@server /usr/home/user]# cat /boot/loader.conf

Example: New installation of FreeBSD.

kern.geom.label.disk_ident.enable="0"
kern.geom.label.gptid.enable="0"
vfs.zfs.min_auto_ashift=12
zfs_load="YES"

Example: Modules and parameters added for a Intel HW based FreeBSD Server.

kern.geom.label.disk_ident.enable="0"
kern.geom.label.gptid.enable="0"
vfs.zfs.min_auto_ashift=12
zfs_load="YES"

# How many seconds to sit at the boot menu before booting
autoboot_delay="3"

# Use new graphical consol driver
kern.vty="vt"
hw.vga.textmode=1

# Displayed the colored Beastie logo to the right of the boot options menu
loader_logo="beastie"

Optional: Add Local User

The adduser utility is a shell script, implemented around the pw(8) command, for adding new users.

N.B.: Remember to invite the user into other group wheel to enable this user login remotely via a ssh client!

Create a new local user for remote login with:

[root@server /usr/home/user]# sudo adduser [enter]
Password: <-- passwd [enter]
Username: username [enter]
Full name: Full Name [enter]
Uid (Leave empty for default):
Login group [username]:
Login group is username. Invite username into other groups? []: wheel [enter]
Login class [default]:
Shell (sh csh tcsh nologin) [sh]:
Home directory [/home/username]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]:
Enter password:
Enter password again:
Lock out the account after creation? [no]:
Username : username
Password : *****
Full Name : Full Name
Uid : 1001
Class :
Groups : username wheel
Home : /home/username
Home Mode :
Shell : /bin/sh
Locked : no
OK? (yes/no): yes [enter]
adduser: INFO: Successfully added (username) to the user database.
Add another user? (yes/no): no [enter]
Goodbye!
[root@server /usr/home/user]#

Completion of Basic Installation

Power off the server with:

[root@server /usr/home/user]# poweroff [enter]

Wait for the server to perform power off, disconnect the monitor and the keyboard and then start the server again.

That’s it!

Your FreeBSD Headless Server is now ready for the next step, installation of services and utilities to fulfill your need of a secure and reliable local data and web server for your home or small office.

Leave a Reply