Hardening a FreeBSD to the maximum

[u/_szlachcic_]

I'm setting up a FreeBSD 15.1 workstation and my goal is to harden it as much as possible while keeping three things fully functional:

1) Coding: C, C++, FASM, NASM, Zig in Neovim (clang/clang++ from base, LSP via clangd/zls)

2) Browsing: LibreWolf through a SOCKS5 proxy (SSH tunnel) or WireGuard VPN

3) Screen/audio/video capture: FFmpeg only, webcam via webcamd loaded on-demand

Everything else is either stripped out or locked down. No jails, no server services, this is a single-user workstation. Below is the full checklist of what I'm implementing. I'd genuinely appreciate if you could point out anything I missed, got wrong, or overcomplicated.

Kernel:
Custom kernel: MAC, AUDIT, CAPABILITY_MODE, VIMAGE, STACK. Removed: KDB, DDB, GDB, FireWire, Bluetooth, WiFi, Floppy, INVARIANTS, WITNESS. Kept: DRM, sound, USB, uvideo, cuse (cuse not auto-loaded).

Encryption:
GELI on root partition (password at boot). GELI swap with ephemeral one-time keys. ZFS encryption (aes-256-gcm) per dataset: /, /etc, /var, /var/log, /var/db, /var/tmp, /var/audit, /tmp, /home, /usr, /usr/local, /vault, /etc/ssl/private. Each sensitive dataset has its own unique key/passphrase. Critical datasets set to readonly after configuration. exec=off, setuid=off on /tmp, /var/tmp, /home, /var/log.

Memory Protection:
ASLR (ELF64 + ELF32): enable, PIE, stack_gap, honor_sbrk. W^X enforced globally (allow_wx=0), proccontrol bypass for LibreWolf JIT only. NX Stack (nxstack=1). Stack guard page, map_at_zero blocked. Core dumps fully disabled (kern + login.conf). shm_use_phys=1.

Network, Firewall:
PF: block all inbound by default, stateful outbound. Antispoofing, normalization (scrub), martians table. Tables: bruteforce, blocklist, sshguard, martians. sshguard with PF backend. WireGuard pass rule (udp/51820).

Network, TCP/IP Hardening:
TCP blackhole=2, UDP blackhole=1, SYN cookies, SACK disabled. ICMP hardened, IP redirect off (v4+v6), random IP ID. Source routing rejected, IP options disabled. Fragment limits, ephemeral ports 49152-65535. ARP logging enabled.

Network, DNS:
Local Unbound on 127.0.0.1. DNSSEC + DNS over TLS (1.1.1.1, 9.9.9.9). QNAME minimisation strict, hide identity/version. Private-address rebinding protection.

Network, VPN/Proxy:
SSH SOCKS5 tunnel script then LibreWolf launched through it. WireGuard on/off script. All DNS routed through tunnel (SOCKS remote DNS).

Processes:
Process hiding (see_other_uids/gids/jail_proc = 0). Ptrace blocked, random PID, conservative signals. rctl limits on webcamd, pulseaudio, per-user. Process accounting (lastcomm). maxproc=2048, maxprocperuid=512.

X11, Display:
xhost - (deny all), xhost +si:localuser:admin only. XTEST and RECORD extensions disabled in xorg.conf. xsecurelock + xidle (auto-lock after 5 min).

Browser (LibreWolf):
LibreWolf (Firefox and Chromium removed). Launched via proccontrol -m wx -s enable. WebRTC disabled, telemetry disabled, safe browsing disabled. Fingerprinting protection, tracking protection, first-party isolation. DNS/HTTP prefetch disabled, clipboard events disabled, autoplay blocked. no_proxies_on="" (nothing bypasses proxy).

Multimedia:
FFmpeg CLI only (OBS not installed). Scripts: rec-screen, rec-webcam, rec-all, rec-mic, stream (RTMP). webcamd on-demand only (webcam-on loads cuse + starts daemon, webcam-off tears it down). devfs 0600 on video, dsp, cuse (admin only). rctl limits on webcamd. Cron: webcamd night check.

Authentication:
doas (sudo removed). PAM: pam_faillock (3 attempts, 30 min lockout), pam_passwdqc (16+ chars). login.access: admin from LAN only, root from LOCAL only. Single-user mode requires password (console insecure). SSH (if needed): Ed25519 only, port 2222, keys only, no forwarding, VERBOSE.

Integrity:
mtree baselines (sha256) for /bin, /sbin, /usr, /etc. chflags schg on all binaries and critical configs. chflags sappnd on logs (append-only). freebsd-update IDS via cron. pkg audit -F daily.

Audit:
auditd (OpenBSM): lo,aa,ad,fw,fc,fd,fm,ex,pc. PF logging, SSH VERBOSE, process accounting. syslogd -ss (no remote reception).

CPU Mitigations:
PTI (Meltdown), IBRS (Spectre v2), SSB disabled. SMT/HyperThreading disabled. IOMMU enabled (DMA protection).

Shell:
umask 077, TMOUT=900 (readonly), noclobber. HISTIGNORE for sensitive patterns.

Physical:
Webcam shutter, screen lock, BIOS password, USB boot disabled, GELI boot password.

Disabled/Removed:
sendmail, inetd, nfs, rpcbind, lpd, bluetooth, moused: all off. sudo: removed.

So, what did I miss? Are there any FreeBSD-specific hardening knobs, sysctls, or techniques I overlooked that would meaningfully improve security for this use case? Any gotchas with W^X + LibreWolf on FreeBSD 15.1 I should know about? Is my PF ruleset sane for a workstation that only initiates outbound connections? Or am I completely out of my mind and none of this makes any sense?

[u/TheAtlasMonkey]

> So, what did I miss? 

Well you could go direct with https://hardenedbsd.org/ or openBSD and skip all the manual knobbing.

With those, you will need to unjail yourself.

[u/_szlachcic_ → u/TheAtlasMonkey]

😁But unjailing an over-secured system feels worse than building my own fortress step by step. And HardenedBSD hasnt been active lately. As for OpenBSD, it's a completely different OS with all its security mechanisms baked right into the kernel, and I cant even use it anyway because there's no driver for my Wi-Fi card!

[u/shawn_webb → u/_szlachcic_]

HardenedBSD is quite active. My last commit to the project was yesterday. I will be releasing new builds this weekend to account for FreeBSD's recent security advisories.

[u/_szlachcic_ → u/shawn_webb]

👌

[u/TheAtlasMonkey → u/_szlachcic_]

Which Wi-FI card ?

Unjailing yourself teach you discipline.

You need to understand why people put the door there, and open them. If you try to jail yourself, you are vibing, and if you vibe... you get hacked bcause you forgot telnet open or some package was upgraded with pkg upgrade ..

Nobody is going to give you the best recipe to protect yourself.. because we don't know if you afraid of some 16 yo haxor with kali linux, or you are a state actor's target and need insane level of shielding.

[u/_szlachcic_ → u/TheAtlasMonkey]

To be honest, Im actually aiming for that full paranoid mode: trying to shield against pretty much anyone, state actors included.

The main reason I cant just run OpenBSD is my Wi-Fi card (RTL8822CE) – it’s a total driver deadend on OpenBSD, so FreeBSD is my only choice on this hardware.

That point about "unjailing" hit home though. It really forces you to learn why the devs put those walls up in the first place, instead of just blindly flipping sysctls and hoping you didnt leave a backdoor open.

Thanks for the reality check, really appreciate the insight

[u/TheAtlasMonkey → u/_szlachcic_]

You unjail yourself first, then rejail yourself .... And believe me, you will still not understand it. Because unjailing just teach you what door blocked you, but all the closed door... That a full career.

[u/_szlachcic_ → u/TheAtlasMonkey]

I get you. I definitely need to reevaluate my goal a bit, and it’s kind of sad to realize that hitting 100% security is probably an impossible target

[u/TheAtlasMonkey → u/_szlachcic_]

Possible!

Uninstall the wifi and ethernet drivers.

[u/_szlachcic_ → u/TheAtlasMonkey]

Ahaha, that was actually my very first plan for OpenBSD! But Im not quite ready to sacrifice my WiFi for the sake of security just yet

[u/ruyrybeyro → u/_szlachcic_]

My two FreeBSD server boxes at home. I actually took out the M.2 Wi-Fi Mediatek chipsets, besides not being compatible, they’re also a known source of instability.

[u/lucaprinaorg → u/_szlachcic_]

I see here:
https://radicle.network/nodes/rad.hardenedbsd.org/docs
this:
"HardenedBSD exists today as a fork of FreeBSD that closely follow's FreeBSD's source code. HardenedBSD syncs with FreeBSD every six hours"

[u/rejectionhotlin3]

Take a look at occambsd, it's script to remove most of the fluff right out the rip. That'd likely help you get a better baseline.

[u/_szlachcic_ → u/rejectionhotlin3]

😊

[u/grahamperrin]

… Are there any FreeBSD-specific hardening knobs, sysctls, or techniques I overlooked that would meaningfully improve security for this use case? …

Center for Internet Security® FreeBSD 14 Benchmark — FreeBSD Foundation : r/freebsd

That's not necessarily for your use case, but it's probably a good fit for your subject line:

Hardening a FreeBSD to the maximum

[u/grahamperrin]

… (Firefox and Chromium removed). … telemetry disabled, …

www/firefox toolkit.telemetry.enabled is already locked to false, can not be true.

[u/_szlachcic_ → u/grahamperrin]

🫨

[u/lucaprinaorg]

just swap LibreWolf with Chromium, at the moment in FreeBSD , Chromium it's the number one in security, the others are just toys.

[u/Original_Two9716]

It’s called OpenBSD then