%includes; ]> &header; There are several steps involved in securing a FreeBSD system, or in fact any UNIX system:

• disabling potentially dangerous software
  A lot of software has to be run as a special privileged user to make use of specific resources, bij making the executable set-uid. An example is UUCP software or PPP software that makes use of a serial port, or sendmail which has to write in the mail spool and bind to a network port. When you are not using UUCP, it is of little use to have the software on your system and it may be wise to disable it. Of course, this requires good knowlegde of what can be thrown away and what not, as well as a good indication whether or not you will want the functionality in the future.
  Also some utilities you may find not interesting enough to have them around and pose a possible security risk, like swapinfo. If you remove the set-uid bit for the executable (via chmod ug-s filename) you can always keep on using swapinfo when you're root. It is however not a good idea stripping so many sbits you have to be root all the time.
  Not only remove programs that you don't use, also remove services you don't want or need to provide. This can be done by editting the /etc/inetd.conf file and uncommenting out all services you don't use.
• fixing software with security bugs
  Subscribe yourself to mailinglist to get updates on security bugs in software and to get the fixes. Apply them immediately.
• checking your system on a regular basis
  With programs like COPS and SATAN you can find gaping holes and misconfigurations on your system. It is a good idea to run them occasionaly to see if you have made any mistakes.
  Also check the daily security reporting that FreeBSD send to root. Check the logfiles once in a while. Clean up unused accounts.
• being able to repair your system when security has been breached
  Always have backups and a clean version of the operating system (e.g. on CD-ROM).
• installing software that watches the system
  Programs like the tcp wrapper (a package with FreeBSD) and tripwire help you monitor activity on your system. This makes it easier to detect breakins.
• educating the people working on the system
  Users should know what they are doing, and e.g. use hard to guess password. Let them understand that the security of the system is partly in their hands.

&footer