Is a FreeBSD server really THAT much more insecure than an OpenBSD one? reddit / freebsd ---------------------------------------------------------------------- kyleW_ne · 2020-11-01 07:12 EDIT: One of the reasons that prompted me to post this question is this youtube video: https://www.youtube.com/watch?v=AvSPqo3_3vM and the fact that a FreeBSD rootkit book exists on Amazon. ---------------------------------------------------------------------- alkymistendenmark · 2020-11-01 07:32 No ---------------------------------------------------------------------- [deleted] · 2020-11-01 07:48 No, but you can follow these links to improve it more: * [https://vez.mrsk.me/freebsd- defaults.html](https://vez.mrsk.me/freebsd-defaults.html) * [https://reviews.freebsd.org/D6826](https://reviews.freebsd.org/D6826) ---------------------------------------------------------------------- kub-kun · 2020-11-01 09:27 No bro. I run my personal server (nginx and teamspeak3server) on FreeBSD and never got hacked or something. I recommend using ssh via keys not password. ---------------------------------------------------------------------- ngc-bg · 2020-11-01 09:44 No, it is not insecure. Just OpenBSD is more secure. Joke aside, out the box obsd install is very secure and audited. Openbsd is the upstream for openssh and pf, so basically they should be more secure as well. Freebsd is stable, secure OS as well of course. ---------------------------------------------------------------------- fasync · 2020-11-01 09:48 FreeBSD and OpenBSD maybe have different focus areas, but that doesn't mean that FreeBSD is insecure and OpenBSD is incredible slow. Security does depend of many variables, not only the OS. But if you just think about system security, here is a little comparison between FreeBSD and OpenBSD: **Memory Protection:** * ASLR: OpenBSD enables ASLR by default, FreeBSD disable it by default. The feature is indeed pretty new to FreeBSD, it got implemented a year ago. * W\^X: This is a OpenBSD only feature. FreeBSD just use the NX Bit. That's not bad either. * Stack Protector: Both OpenBSD and FreeBSD use a Stack protector / Stack smashing protection canary. * mmap: Both FreeBSD and OpenBSD prevents calling mmap() with pages which are NULL. * Other: FreeBSD got RedZone for example, OpenBSD has some special functions in their LibC to avoid typical security flaws. ​ **Privilege Separation:** * FreeBSD has Capsicum, OpenBSD uses pledge. Both works pretty solid. ​ **Code Quality and defaults:** * OpenBSD is under heavy code auditing which can increase security pretty much. They keep their code pretty simple, readable and clean. FreeBSD also does code audits, but not that much as OpenBSD does. * OpenBSD has many secure defaults, FreeBSD does serves some balanced defaults ​ There is one feature I miss in OpenBSD and I love in FreeBSD: **Jails**. ​ And these are only *some* examples of some features. This is by far not a whole comparison, but maybe it gives you a idea how hard it is to compare the security of the two systems. That said it is important to keep my first sentence in mind: They have different focus area, and while OpenBSD has a bunch of pro active security features, it comes with the cost of restrictions. Does that in the end mean that FreeBSD is much more insecure because it has less of these cool features: **No.** FreeBSD does a fairly good job at creating a balance between performance, software availablity and security. Security is always a tradeof, and the most important is to configure your system in a smart and secure way. ​ PS: If I'm incorrect or imprecise with something please correct me, maybe I'm not 100% up to date. ---------------------------------------------------------------------- Xzenor · 2020-11-01 10:51 It's not binary, dude.... ---------------------------------------------------------------------- mtemmerm · 2020-11-01 13:28 Of course not, why would you assume it is? ---------------------------------------------------------------------- beowuff · 2020-11-01 17:29 How does HardenedBSD(based on FreeBSD) stack up against OpenBSD? I suspect it’s a decent compromise between the other two. ---------------------------------------------------------------------- edthesmokebeard · 2020-11-01 22:04 This feels like a troll. ---------------------------------------------------------------------- zieziegabor · 2020-11-01 23:08 The HBSD people will say it's more secure. HBSD is almost certainly more secure than FBSD, since many(all?) of the security defaults are changed to be on for HBSD. One downside to HBSD, is it requires some hand holding when you compile software. With all the security bits turned on, there can be some fine tuning to get your code compiled, and even to get your binaries to run. This isn't bad, but it does require some babysitting. Luckily once you get it worked out, you can update the wiki, and you and everyone else never has to care again. There is some work to make this more streamlined as part of the FS attributes, which would be nice, but I don't think that's landed in a stable branch yet. I think it's arguable. There is almost certainly more bugs in HBSD, since the developer base is small and the code size is absolutely giant compared to OBSD. ZFS alone is larger than all of OBSD's base system(last I looked). So there is WAY more code (and features) in HBSD. Hopefully most of the mitigations in HBSD make those bugs either stand out or harmless, but nobody really knows. Personally, if I need one of the features (like ZFS or Jails, etc) then I run HBSD. If I don't, then I run OBSD. ---------------------------------------------------------------------- kyleW_ne · 2020-11-02 05:26 Nope just genuinely curious if the difference is that big. ---------------------------------------------------------------------- kyleW_ne · 2020-11-02 05:30 The meta in all the forms I read say otherwise and looking to get an honest assessment. This youtube video: https://www.youtube.com/watch?v=AvSPqo3_3vM ---------------------------------------------------------------------- kyleW_ne · 2020-11-02 05:40 Thank you kind stranger. I edited the post to reflect the youtube video I watched and book I found that made me question things. Trying to decide between OpenBSD and FreeBSD for a personal server and don't want to get hacked. I feel like Jails are a killer feature in FreeBSD. I run FreeBSD on my workstation at home and really like how well the project is engineered. ---------------------------------------------------------------------- kyleW_ne · 2020-11-02 05:42 Thank you, looking at this now. EDIT: That first link is rather alarming. Are things still in such a poor state with pkg and such? ---------------------------------------------------------------------- mtemmerm · 2020-11-02 09:27 I don't understand what you're talking about with the meta in forms I'm afraid. That video points out different goals of the different projects, but it doesn't mean one bsd is less secure than another. Yes, openbsd has a smaller attack surface and different mitigations. But I can set it up in an insecure way just the same. I suggest you try them both out. ---------------------------------------------------------------------- desnudopenguino · 2020-11-10 06:54 Along with what the guy above posted, if you have a limited budget, FreeBSD might be a bit more performant with jails allowing for some segregation of services. I like to run with one service per "system" in prod to keep things separated. Any OS can be insecure with a bad config for a service or weak user security. If your personal server is a web server, read up on security for the stack you want to use. You have to mitigate things like sql injection, xss, form validation, crawlers, etc... That may not directly give access, but can be used to exploit your site for other nefarious purposes. ---------------------------------------------------------------------- kyleW_ne · 2020-11-10 07:49 Thank you so much. I'm leaning towards FreeBSD for my solution. My work lets one collocate a server at one of their data centers so I'm setting up a personal web server but I also want it to host important backup items like saves from my favorite games, important documents, and pictures. ZFS should serve me well for that purpose and is why I'm leaning against OpenBSD that data checksumming is just so important. HardnedBSD should be an option but I don't like how it has like 3 developers total so not a lot of eyes on that code. I don't know what physical server hardware I will be using yet but probably some kind of Dell Poweredge from the last few years. I was hoping to get something free that was being decommissioned at work, but they opped to try to get every penny out of the hardware by selling it instead. ---------------------------------------------------------------------- desnudopenguino · 2020-11-10 07:55 If you get some solid hardware, you could set up a solid VM host with bhyve or xen on FreeBSD and go to town with vms and jails. I run OpenBSD as my daily driver desktop/laptop and run FreeBSD for most of my server work due to jails and zfs. I never was able to out together a solid docker/k8s setup on Linux, so jails have continued to grow on me since I first experimented with them over a decade ago. ---------------------------------------------------------------------- opinions_unpopular · 2020-11-12 02:07 The rootkit book is a great book for learning the kernel and kernel module interfaces. The author was involved with FreeBSD. They aren’t some kid hacker. It does not even get close to explaining how to keep “the” rootkit persistent without accidentally being removed or seen in kernel debug interfaces.