The First 5 Minutes on a New FreeBSD Server
This is inspired by a 2013 blog post by Sol Love.
It’s in no way a complete guide and when setting up more than one instance at a time, you should probably automate most/all of the steps. For the occasional server setup it’s a good enough checklist to work through.
The snippets are compatible with a basic copy-and-paste approach.
Turn off ZFS access time flag
zfs set atime=off zroot
Disable login messages
touch ~/.hushlogin
Disable sendmail, enable DMA
service sendmail stop && \
sysrc sendmail_enable="NONE" && \
cat << EOF > /etc/mail/mailer.conf
sendmail /usr/libexec/dma
send-mail /usr/libexec/dma
mailq /usr/libexec/dma
newaliases /usr/libexec/dma
rmail /usr/libexec/dma
hoststat /usr/bin/true
purgestat /usr/bin/true
EOF
Disable legacy SSH host keys and regenerate**
sysrc sshd_enable="YES" && \
sysrc sshd_dsa_enable="NO" && \
sysrc sshd_ecdsa_enable="NO" && \
sysrc sshd_ed25519_enable="YES" && \
sysrc sshd_rsa_enable="YES" && \
rm /etc/ssh/ssh_host_* && \
service sshd keygen && \
service sshd restart
Update base system
freebsd-update fetch install && \
reboot
After the reboot:
freebsd-update install
Install basic software
pkg install doas fish git htop mosh neovim && \
chsh -s /usr/local/bin/fish
Set up doas
cat << EOF > /usr/local/etc/doas.conf
permit nopass :wheel
EOF
Set up PF firewall
cat << EOF > /etc/pf.conf
ext_if = "vtnet0"
tcp_pass = "{ ssh }"
udp_pass = "{ 60000:60010 }"
set block-policy drop
scrub in on $ext_if all fragment reassemble
set skip on lo
# table <jails> persist
# nat on $ext_if from <jails> to any -> ($ext_if:0)
# rdr-anchor "rdr/*"
block in log all
pass out log keep state
antispoof for $ext_if inet
antispoof for $ext_if inet6
pass in log on $ext_if proto tcp from any to any port $tcp_pass flags S/SA modulate state
pass in log on $ext_if proto udp from any to any port $udp_pass
pass inet proto icmp all icmp-type echoreq keep state
pass in quick proto icmp6 all
EOF
sysrc pf_enable="YES" && \
sysrc pflog_enable="YES" && \
service pf start && \
service pflog start
Set up time synchonisation
sysrc ntpd_enable="YES" && \
service ntpd restart
Reboot
reboot