How to Perform a Security Compliance Check on FreeBSD Operating System

FreeBSD is a robust and secure operating system known for its advanced networking, security, and storage features. However, maintaining its security compliance is crucial for organizations that must adhere to regulatory standards or simply wish to ensure their systems are well-protected. Performing a security compliance check on FreeBSD involves assessing its configuration, auditing security policies, and ensuring adherence to industry best practices.

1. Understanding Security Compliance on FreeBSD

Security compliance involves verifying that a system meets certain security policies, regulations, or industry standards such as ISO 27001, PCI-DSS, or CIS benchmarks. A FreeBSD security compliance check ensures the system is configured to prevent vulnerabilities, unauthorized access, and data breaches.

2. Preparing for a Security Compliance Check

Before starting a security compliance check, it’s important to:

• Define Security Requirements: Identify applicable security standards such as NIST, CIS, or company policies.
• Ensure System Backup: Back up critical data and configurations before making changes.
• Update the System: Use freebsd-update fetch install and pkg update to ensure the system is up to date.

3. Conducting a FreeBSD Security Audit

3.1. Checking System Integrity

• Verify Installed Packages:

  pkg audit -F
  

  This command checks installed packages for known vulnerabilities.

• Verify System Integrity:

  freebsd-update IDS
  

  This checks system files for unauthorized modifications.

3.2. Checking User Accounts and Privileges

• List Users and Groups:

  cat /etc/passwd
  cat /etc/group
  

• Check for Empty Passwords:

  awk -F: '($2 == "") {print $1 " has no password"}' /etc/shadow
  

• Audit Sudo Access:

  cat /usr/local/etc/sudoers
  

3.3. Auditing File System and Permissions

• List World-Writable Files:

  find / -type f -perm -o+w -exec ls -lh {} \;
  

• Check for SUID/SGID Files:

  find / -perm -4000 -o -perm -2000 -exec ls -lh {} \;
  

• Verify Permissions on Critical Files:

  ls -l /etc/passwd /etc/shadow /etc/group /etc/master.passwd
  

4. Network Security Checks

4.1. Checking Open Ports and Services

• List Listening Services:

  sockstat -l
  

• Verify Running Services:

  service -e
  

4.2. Firewall Configuration

• Check PF Firewall Rules:

  pfctl -sr
  

• Ensure IPFW or PF is Enabled:

  sysrc firewall_enable=YES
  

4.3. SSH Security Audit

• Verify SSH Configuration:

  grep -E 'PermitRootLogin|PasswordAuthentication|PubkeyAuthentication' /etc/ssh/sshd_config
  

  Ensure:

  • PermitRootLogin no
  • PasswordAuthentication no
  • PubkeyAuthentication yes

5. Logging and Monitoring

5.1. Configuring System Logging

• Check Syslog Configuration:

  cat /etc/syslog.conf
  

• View Recent Logins:

  last
  

• Check Authentication Logs:

  tail -f /var/log/auth.log
  

5.2. Enabling Auditd for Detailed Monitoring

• Enable Auditd:

  sysrc auditd_enable=YES
  service auditd start
  

• Configure Audit Rules: Edit /etc/security/audit_control to define what should be logged.

  flags:lo,ad,ex
  minfree:20
  naflags:lo
  

  Restart Auditd:

  service auditd restart
  

6. Automating Compliance Checks

6.1. Using Security Tools

• Install and Use Lynis for Security Audits:

  pkg install lynis
  lynis audit system
  

  Lynis provides a detailed security assessment.

• Using Bastille for System Hardening:

  pkg install bastille
  bastille -a
  

  This tool helps harden FreeBSD systems automatically.

7. Reviewing and Enforcing Compliance Policies

• Regularly Update Security Policies: Ensure configurations are aligned with industry standards.
• Perform Routine Security Audits: Automate checks using cron jobs.
• Implement Role-Based Access Control (RBAC): Limit administrative privileges.

Conclusion

Performing a security compliance check on FreeBSD requires a structured approach, covering system integrity, user privileges, network security, logging, and automation tools. By following these steps, administrators can ensure their FreeBSD systems remain secure and compliant with security best practices and regulatory requirements.