Learn DragonFlyBSD - Security Features & Hardening

#Introduction

In episode 14 you protected the transport encryption layer with TLS and certificates. But good defense doesn't stop at one door — it wraps the whole building. This episode is about strengthening the entire system: tuning kernel parameters via sysctl, using exploit mitigations, and monitoring activity so anomalies are visible early.

Imagine a house that already has a strong door (SSH) and locked windows (TLS). Hardening is finishing the rest: installing motion sensors (monitoring), scrambling the room layout (ASLR), and turning off unused appliances. No single step is magical — what makes a house safe is many small layers stacked together.

#sysctl Security Settings

#Viewing Parameters

sysctl is the kernel's window and steering wheel. All the security parameters that can be changed at runtime are read with:

View kernel security parameters

sysctl kern.securelevel
sysctl -a | grep -i sec

kern.securelevel is the kernel's security level: the higher it is, the more operations are locked against runtime modification. Some parameters commonly hardened:

Parameter	Safe Setting	Effect
`kern.securelevel`	1	Locks time, mount, and important file changes
`net.inet.ip.forwarding`	0	Disables IP forwarding if you're not a router
`net.inet.tcp.cc.algorithm`	per load	Congestion control algorithm
`vfs.usermount`	0	Prevents users from mounting filesystems

#Applying sysctl Permanently

Parameters changed via sysctl only last until reboot. To make them permanent, write them in /etc/sysctl.conf:

Example /etc/sysctl.conf

kern.securelevel=1
net.inet.ip.forwarding=0
vfs.usermount=0

Then apply without rebooting:

Apply sysctl.conf

sysctl -f /etc/sysctl.conf

#PaX-Like Mitigations & ASLR

DragonFlyBSD carries kernel-class exploit mitigations — the same spirit as the PaX project on Linux. The most visible one is ASLR (Address Space Layout Randomization): a process's memory addresses are randomized every time a program runs, so exploits that depend on fixed addresses (like ROP) become far harder.

Checking the status of ASLR and related mitigations:

Check ASLR mitigations

sysctl kern.aslr.enable
sysctl kern.random_vectoring_enable

Parameters like kern.aslr.enable control address randomization for new processes. Together with stack protection and W^X, which are active in the default compiler, DragonFlyBSD provides solid exploit defense without requiring extra configuration from the administrator.

Info

Kernel mitigations aren't a substitute for application hygiene — they're a safety net. Prioritize keeping packages updated (pkg upgrade), turning off unused services, and applying least privilege. Mitigations work best when they never have to be used.

#Hardening Best Practices

Here's a hardening checklist you can apply right away:

Turn off unused services: service <name> stop then set _enable="NO" in rc.conf.
Apply a deny-by-default firewall (episode 12) and SSH hardening (episode 13).
Restrict sensitive file access: chmod 600 /etc/ssh/ssh_host_ed25519_key.
Update the system regularly: pkg upgrade and base system binary updates.
Monitor cron and logs — no secret task should run without a trace.
Set kern.securelevel=1 once the system is stable.

#Security Monitoring

#tcpdump

tcpdump captures network packets — the most important tool for investigating suspicious behavior:

Capture SSH traffic

tcpdump -i em0 port 22
tcpdump -i em0 -n 'icmp and dst 192.168.1.10'

The first line shows all traffic on port 22; the second filters ICMP toward a specific address. For deeper analysis, write the capture to a file and open it in Wireshark:

Save a capture for analysis

tcpdump -i em0 -w /tmp/capture.pcap

#netstat

netstat shows network connections — who is connected and where:

View active connections

netstat -an
netstat -an | grep ESTABLISHED

-a all sockets, -n no name resolution. Unknown ESTABLISHED connections are an early sign of intrusion. Also watch the open port list (LISTEN) — make sure only services you know are there.

#systat

systat is a real-time system performance dashboard:

System dashboard

systat -vmstat
systat -netstat
systat -ip

-vmstat shows CPU and memory, -netstat network traffic, -ip IP statistics. For security monitoring, the combination of tcpdump (suspicious packets), netstat (unknown connections), and systat (load anomalies) gives an almost complete picture.

#Closing

In this episode 15 you strengthened DragonFlyBSD thoroughly: setting sysctl security settings with kern.securelevel, applying PaX-like mitigations and ASLR, applying hardening best practices, and monitoring security with tcpdump, netstat, and systat.

Key takeaways:

sysctl reads and changes kernel parameters; persist them in /etc/sysctl.conf.
kern.securelevel is the kernel's security level — raise it once the system is stable.
ASLR and PaX-like mitigations randomize memory addresses and hinder exploits.
Hardening = regular updates + minimal services + firewall + least privilege.
tcpdump for packets, netstat -an for connections, systat -vmstat for system load.

In the next episode, episode 16, we enter advanced networking: advanced networking & routing. You'll run dynamic routing with bird, look at NAT64, tunneling, and put together a reliable production bridge and VLAN setup.