You can also recursively change the flags on a directory tree with the −R flag. For example, to make your *bin directory immutable, you could use this command:
..........................................................................................
# chflags −R schg /bin
..........................................................................................
And boom! Your basic binaries cannot be changed.
To remove a flag, use chflags and a "no" in front of the flag name. For example, to unset the schg flag we just set on your kernel, enter this command:
..........................................................................................
# chflags noschg /kernel
..........................................................................................
That said, you'd have to be running at securelevel −1 to unset this flag. So, without further ado, we'll discuss securelevels and what they mean to you.
Securelevels
Securelevels are kernel settings that change basic system behavior to disallow certain actions. The kernel will behave slightly differently as you raise the securelevel. For example, at low securelevels the file flags we discussed can be removed. A file might be marked "do not remove," but you can remove the marker and then delete the file. When you increase the securelevel, the flag cannot be removed. Similar changes will take place in other parts of the system. Taken as a whole, the behavior changes that result from increased securelevels will either frustrate or stop an intruder. Y o u c a n s e t t h e s y s t e m s e c u r e l e v e l a t b o o t w i t h t h e r c . c o n f o p t i o n s kern_securelevel_enable="YES".
Securelevels make system maintenance difficult by imposing certain restrictive conditions on system behavior. After all, many actions that you might take during normal administration are also things that intruders might do to cover their tracks. For example, when using securelevels you will need to take extra steps to patch your system. On the other hand, securelevels will frustrate the heck out of your average intruder who wishes to destroy data, plant a Trojan, or damage the system in some other way.
Setting Securelevels
Securelevels come in five levels: ‘, 0, 1, 2, and 3, with ‘ being the lowest and 3 being the highest.
Once you enable securelevels with the kern_securelevel_enable="YES" rc.conf option (as discussed previously), you can set the securelevel automatically at boot with the kern_securelevel=X rc.conf variable. While you can raise the
150
system securelevel at any time, you cannot lower it without rebooting into single−user mode. (If you could lower the securelevel without rebooting, so could an intruder.)
Securelevel ‘
Securelevel ‘, the default mode, provides no additional kernel security whatsoever. If you're learning FreeBSD and are frequently changing your configuration, remain at securelevel ‘ and use BSD's built−in file permissions and other UNIX safeguards as security, which should be adequate for most situations.
Securelevel 0
The only time securelevel 0 is used is when your system is first booting, and it offers no special features. When the system reaches multi−user mode, however, the securelevel is automatically raised to 1. (Setting kern_securelevel=0 in /etc/rc.conf is effectively the same as setting kern_securelevel=1.) As such, there's really not much reason to use a securelevel of 0.
Securelevel 1
At a securelevel of 1, things become interesting:
∙You cannot load or unload kernel modules with kldload*kldunload (see Chapter 4).
∙Programs cannot write directly to system memory via either the /dev/mem or /dev/kmem devices.
∙Mounted disks cannot be written to directly, so you cannot format partitions. (You can write files to disk via the standard kernel interface; you just cannot format disks or address the raw devices.)
∙You cannot start the X Window System.
The most obvious effect of securelevel 1 is that the BSD−specific filesystem flags cannot be altered. If a file is marked immutable and you want to replace it, you're out of luck.
Securelevel 2
A securelevel of 2 gives you all the benefits of securelevel 1 with two additions:
∙You cannot write directly to either mounted or unmounted filesystems.
∙You cannot alter the system time by more than 1 second at a time.
Both of these can seem irrelevant to a new sysadmin, but they are important tricks in security. Although UNIX provides handy tools, such as text editors to write to files, it is also possible to bypass those tools and, indeed, bypass the actual filesystem to access the underlying ones and zeros encoded on the disk. If you could do this, you could change any file regardless of the permissions. The only time this happens in common use is when you are installing a new hard disk.
151
Normally, only the root user can write directly to the disk in this manner. With this securelevel set, even root cannot do this.
Similarly, another hacker trick is to change the system time, edit a file, and change it back. That way, when the administrator looks for files that might be causing trouble, the tampered file will appear to have been untouched for months or years, and hence not seem an obvious source of concern.
Securelevel 3
Securelevel 3 is called network secure mode. It behaves exactly like securelevel 2, but it prevents changes to IPFW or IPFilter rules. (We discuss these programs in Chapter 11 and Chapter 8, respectively.) If you have a system with packet filtering or bandwidth management enabled, and those rules are well tuned and unlikely to change, you can use securelevel 3.
Which Securelevel Do You Need?
The securelevel appropriate to your environment will depend on your situation. For example, if you've just put a FreeBSD machine into production and you need to fine−tune it, you should leave the securelevel at ‘. Once your system is fine−tuned, however, you can raise the securelevel, and most systems will run just fine at a securelevel of 2.
It's a good idea to use the schg and sappnd flags on selected files to help protect yourself, because the added clock−changing protection throws up still more ways to force a hacker to show herself.
If you use one of FreeBSD's packet−filtering/firewall packages, you might consider using securelevel 3. However, if you choose to use securelevel 3, be very certain of what you're doing and why, or you're liable to run into problems. For example, if you're using your FreeBSD system as a corporate firewall, securelevel 3 will disallow firewall configuration changes without interrupting your Internet connection. That said, if you're using securelevel 3 to restrict access to certain ports on your Web server, a securelevel of 3 is probably fine.
What Won't Securelevel and File Flags Do?
Consider a case where someone compromises a CGI script on your Apache Web server, uses that to bootstrap himself into a shell, and then uses the shell to bootstrap himself into root access.
Perhaps, because you've set the securelevel accordingly, this attacker gets frustrated because he can't replace your kernel with his specially compiled one. No problem; he can still replace a variety of system binaries with Trojan−horse versions, so that the next time you log in, your new version of login will send your password to an anonymous Web−based mailbox or to an Internet newsgroup.
So, to protect your key files, you run around doing schg −R /bin/*, schg −R /usr/lib, and so on. Fine. If you forget one file—say, something obscure like /etc/rc.i386 or something like that—your hacker can edit that file to include chflags −R noschg /. He can then reboot your system some time late at night, when you might not notice. (How often do you sit down and exhaustively audit your /etc/rc files?)
You think that your system is safe, with every file completely protected. But what about /usr/local/etc/rc.d, the local program startup directory? The system boot process will try to execute anything it finds in this directory with a .sh extension. As such, your hypothetical hacker could do a lot of damage by placing a simple shell script there. After all, /etc/rc raises the securelevel as the
152