13.1. | What is a sandbox? |
«Sandbox» is a security term. It can mean two things:
UNIX(R) implements two core sandboxes. One is at the process level, and one is at the userid level. Every UNIX(R) process is completely firewalled off from every other UNIX(R) process. One process cannot modify the address space of another. This is unlike Windows(R) where a process can easily overwrite the address space of any other, leading to a crash. A UNIX(R) process is owned by a particular userid. If
the userid is not the | |
13.2. | What is securelevel? |
The securelevel is a security mechanism implemented in the
kernel. Basically, when the securelevel is positive, the
kernel restricts certain tasks; not even the superuser (i.e.,
To check the status of the securelevel on a running system, simply execute the following command:
The output will contain the name of the sysctl(8)
variable (in this case, You cannot lower the securelevel of a running system; being
able to do that would defeat its purpose. If you need to do a
task that requires that the securelevel be non-positive (e.g.,
an For more information on securelevel and the specific things all the levels do, please consult the init(8) manual page. Προειδοποίηση:Securelevel is not a silver bullet; it has many known deficiencies. More often than not, it provides a false sense of security. One of its biggest problems is that in order for it to be at all effective, all files used in the boot process up until the securelevel is set must be protected. If an attacker can get the system to execute their code prior to the securelevel being set (which happens quite late in the boot process since some things the system must do at start-up cannot be done at an elevated securelevel), its protections are invalidated. While this task of protecting all files used in the boot process is not technically impossible, if it is achieved, system maintenance will become a nightmare since one would have to take the system down, at least to single-user mode, to modify a configuration file. This point and others are often discussed on the mailing lists, particularly the ηλεκτρονική λίστα του FreeBSD για θέματα ασφάλειας. Please search the archives here for an extensive discussion. Some people are hopeful that securelevel will soon go away in favor of a more fine-grained mechanism, but things are still hazy in this respect. Consider yourself warned. | |
13.3. | BIND ( |
BIND uses a random high-numbered port for outgoing
queries. If you want to use port 53 for outgoing queries,
either to get past a firewall or to make yourself feel
better, you can try the following in
options { query-source address * port 53; }; You can replace the Congratulations, by the way. It is good practice to read your sockstat(1) output and notice odd things! | |
13.4. | Sendmail is listening on port 587 as well as the standard port 25! What is going on? |
Recent versions of Sendmail support a mail submission feature that runs over port 587. This is not yet widely supported, but is growing in popularity. | |
13.5. | What is this UID 0 |
Do not worry. Some people use | |
13.6. | Why is |
For security reasons,
If you want |
Αυτό το κείμενο, και άλλα κείμενα, μπορεί να βρεθεί στο ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/
Για ερωτήσεις σχετικά με το FreeBSD, διαβάστε την
τεκμηρίωση πριν να επικοινωνήσετε με την
<questions@FreeBSD.org>.
Για ερωτήσεις σχετικά με αυτή την τεκμηρίωση, στείλτε e-mail στην
<doc@FreeBSD.org>.