Absolute noob question here, what security hardening options in the
installer is recommended for a home desktop setup?
reddit / freebsd

----------------------------------------------------------------------
ffngg · 2020-10-01 19:47

Simply put i've had enough of windows and have decided to switch to
something more secure, after looking around for a bit i came across
FreeBSD and quite liked the sound of it and tried it out in a VM and
liked it.


However as i've only used it in a VM i never gave much thought to the
hardening options, so now that i am considering an actual installation
i'm not really sure what's recommended.


Ultimately i understand that these options are more important for
people running a webserver and not home users, but i wanted to ask to
make sure.

----------------------------------------------------------------------
[deleted] · 2020-10-01 21:28

[deleted]

----------------------------------------------------------------------
ffngg · 2020-10-01 22:41

While an interesting read I'm not exactly sure what to make of it.


As someone extremely inexperienced in this area my takeaway would be
that FreeBSD is rather insecure with a dev team that doesn't
acknowledge it? So for the hardening options, the best would be
ticking everything and then some more fixes later, or just using
something else entirely?

----------------------------------------------------------------------
[deleted] · 2020-10-01 23:11

[deleted]

----------------------------------------------------------------------
ffngg · 2020-10-01 23:53

Interesting to see how split people appear to be on this, some
claiming it's perfectly safe others saying the complete opposite.
Honestly i'm just more confused now, but thanks for the info!

----------------------------------------------------------------------
dddddavidddd · 2020-10-02 02:09

Have you taken a look at [what they all
do](https://www.freebsd.org/doc/handbook/bsdinstall-
post.html♯bsdinstall-hardening)? On my personal machine I don't set
any except to maybe clear `/tmp` (prevents misbehaving programs from
using too much disk space) and to randomize PIDs (why not?). In the
partitioning menu, I also encrypt both swap and the root partition. I
use FreeBSD on my laptop so this would prevent offline data recovery
if it's ever stolen.