Ulaş SAYGIN UlasSAYGINIM

Debian 8 Hardening

Update root's mail recipient. Open /etc/aliases replacing administrator@example.tld with an administrator's email address. This is where logs will be emailed.
```
root:     administrator@example.tld
```
Update the the default umask to 027. Edit the file /etc/init.d/rc and change the following setting:

umask 027

Networking

#Debugging (See also Traffic analysis) ##Linux

# ethtool eth0              # Show the ethernet status (replaces mii-diag)
# ethtool -s eth0 speed 100 duplex full # Force 100Mbit Full duplex

ethtool -s eth0 autoneg off # Disable auto negotiation

The following is from scotthelme.co.uk

Content Security Policy

with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy), you can tell the browser that it can only download content from the domains you explicitly allow http://www.html5rocks.com/en/tutorials/security/content-security-policy/ https://www.owasp.org/index.php/Content_Security_Policy I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'

This is an outdated draft that was used to review the content with FreeBSD contributors. For the latest revision, vist http://shawndebnath.com/articles/2016/03/27/freebsd-jails-with-vlan-howto.html.

FreeBSD Jails with VLAN HOWTO

This article discusses how to set up jails on a FreeBSD 11-CURRENT system utilizing VIMAGE (aka VNET) to provide a virtualized independent network stack for each jail with support for VLAN tagging.

Prerequisites

TL;DR

Create 10GB FreeBSD image using QEMU.
Run the VM using xhyve.
Mount host directory.
Resize the image.

Requisites

OSX
Homebrew

#Jails

Setup network

# /etc/rc.conf

pf_enable="YES"

cloned_interfaces="lo1"
ifconfig_lo1="inet 172.16.1.1 netmask 255.255.255.0"

	# FreeBSD 10.2 -- /etc/sysctl.conf version 0.47
	# https://calomel.org/freebsd_network_tuning.html
	#
	# low latency is important so we highly recommend that you disable hyper
	# threading on Intel CPUs as it has an unpredictable affect on latency, cpu
	# cache misses and load.
	#
	# These settings are specifically tuned for a "low" latency FIOS (300/300) and
	# gigabit LAN connections. If you have 10gig or 40gig you will need to increase
	# the network buffers as proposed. "man tuning" for more information.

	#!/bin/bash

	### Google Domains provides an API to update a DNS "Syntheitc record". This script
	### updates a record with the script-runner's public IP, as resolved using a DNS
	### lookup.
	###
	### Google Dynamic DNS: https://support.google.com/domains/answer/6147083
	### Synthetic Records: https://support.google.com/domains/answer/6069273

	USERNAME=""

	/*
	* This is public domain.
	*/
	#include <sys/types.h>
	#include <sys/event.h>
	#include <sys/socket.h>
	#include <sys/time.h>
	#include <errno.h>
	#include <libgen.h>
	#include <netinet/in.h>

	func ip2int(ip net.IP) uint32 {
	if len(ip) == 16 {
	return binary.BigEndian.Uint32(ip[12:16])
	}
	return binary.BigEndian.Uint32(ip)
	}

	func int2ip(nn uint32) net.IP {
	ip := make(net.IP, 4)
	binary.BigEndian.PutUint32(ip, nn)