freebsd 9.1.1

介绍 (Introduction)

When setting up a new FreeBSD server, there are a number of optional steps you can take to get your server into a more production-friendly state. In this guide, we will cover some of the most common examples.

设置新的FreeBSD服务器时，可以采取许多可选步骤，以使服务器进入对生产更友好的状态。 在本指南中，我们将介绍一些最常见的示例。

We will set up a simple, easy-to-configure firewall that denies most traffic. We will also make sure that your server’s time zone accurately reflects its location. We will set up NTP polling in order to keep the server’s time accurate and, finally, demonstrate how to add some extra swap space to your server.

我们将建立一个简单，易于配置的防火墙，以拒绝大多数流量。 我们还将确保您服务器的时区准确反映其位置。 我们将设置NTP轮询，以保持服务器的时间准确，并最终演示如何向服务器添加一些额外的交换空间。

Before you get started with this guide, you should log in and configure your shell environment the way you’d like it. You can find out how to do this by following this guide.

在开始使用本指南之前，您应该登录并按照自己的方式配置shell环境。 您可以按照本指南了解如何执行此操作。

如何配置简单的IPFW防火墙 (How To Configure a Simple IPFW Firewall)

The first task is setting up a simple firewall to secure your server.

第一项任务是设置一个简单的防火墙来保护您的服务器。

FreeBSD supports and includes three separate firewalls. These are called pf, ipfw, and ipfilter. In this guide, we will be using ipfw as our firewall. ipfw is a secure, stateful firewall written and maintained as part of FreeBSD.

FreeBSD支持并包括三个单独的防火墙。 这些被称为pf ， ipfw和ipfilter 。 在本指南中，我们将使用ipfw作为防火墙。 ipfw是作为FreeBSD的一部分编写和维护的安全的有状态防火墙。

配置基本防火墙 (Configuring the Basic Firewall)

Almost all of your configuration will take place in the /etc/rc.conf file. To modify the configuration you’ll use the sysrc command, which allows users to change configuration in /etc/rc.conf in a safe manner. Inside this file you’ll add a number of different lines to enable and control how the ipfw firewall will function. You’ll start with the essential rules; run the following command to begin:

几乎所有的配置都将在/etc/rc.conf文件中进行。 要修改配置，您将使用sysrc命令，该命令允许用户以安全的方式更改/etc/rc.conf中的配置。 在此文件中，您将添加许多不同的行以启用和控制ipfw防火墙的功能。 您将从基本规则入手； 运行以下命令开始：

Each time you run sysrc to modify your configuration, you’ll receive output showing the changes:

每次运行sysrc修改配置时，您都会收到显示更改的输出：

   

    Output
   
firewall_enable: NO -> YES

As you may expect, this first command enables the ipfw firewall, starting it automatically at boot and allowing it to be started with the usual service commands.

如您所料，第一个命令启用ipfw防火墙，在启动时自动启动它，并允许使用常规service命令启动它。

Now run the following:

现在运行以下命令：

This tells ipfw not to output anything to standard out when it performs certain actions. This might seem like a matter of preference, but it actually affects the functionality of the firewall.

这告诉ipfw在执行某些操作时不要输出任何标准输出。 这似乎是一个优先事项，但实际上会影响防火墙的功能。

Two factors combine to make this an important option. The first is that the firewall configuration script is executed in the current shell environment, not as a background task. The second is that when the ipfw command reads a configuration script without the "quiet" flag, it reads and outputs each line, in turn, to standard out. When it outputs a line, it immediately executes the associated action.

两个因素相结合，使之成为一个重要的选择。 首先是防火墙配置脚本是在当前Shell环境中执行的，而不是作为后台任务执行的。 第二个是，当ipfw命令读取不带"quiet"标志的配置脚本时，它将依次读取并输出每行以输出标准输出。 当输出一行时，它立即执行相关的动作。

Most firewall configuration files flush the current rules at the top of the script in order to start fresh. If the ipfw firewall comes across a line like this without the quiet flag, it will immediately flush all rules and revert to its default policy, which is usually to deny all connections. If you’re configuring the firewall over SSH, this would drop the connection, close the current shell session, and none of the rules that follow would be processed, effectively locking you out of the server. The quiet flag allows the firewall to process the rules as a set instead of implementing each one individually.

大多数防火墙配置文件都会在脚本顶部刷新当前规则，以便重新启动。 如果ipfw防火墙遇到这样的行而没有quiet标志，它将立即刷新所有规则并恢复为其默认策略，该策略通常是拒绝所有连接。 如果您正在通过SSH配置防火墙，则将断开连接，关闭当前的Shell会话，并且不会处理任何后续规则，从而有效地将您锁定在服务器之外。 安静标志允许防火墙将规则作为一组处理，而不是单独实施每个规则。

After these two lines, you can begin configuring the firewall’s behavior. Now select "workstation" as the type of firewall you’ll configure:

在这两行之后，您可以开始配置防火墙的行为。 现在，选择"workstation"作为要配置的防火墙类型：

This sets the firewall to protect the server from which you’re configuring the firewall using stateful rules. A stateful firewall monitors the state of network connections over time and stores information about these connections in memory for a short time. As a result, not only can rules be defined on what connections the firewall should allow, but a stateful firewall can also use the data it has learned about previous connections to evaluate which connections can be made.

这将设置防火墙，以保护您使用状态规则从中配置防火墙的服务器。 有状态防火墙会随着时间的推移监视网络连接的状态，并在很短的时间内将有关这些连接的信息存储在内存中。 结果，不仅可以定义有关防火墙应允许的连接的规则，而且有状态防火墙还可以使用它所了解的有关先前连接的数据来评估可以建立哪些连接。

The /etc/rc.conf file also allows you to customize the services you want clients to be able to access by using the firewall_myservices and firewall_allowservices options.

/etc/rc.conf文件还允许您通过使用firewall_myservices和firewall_allowservices选项来自定义希望客户端能够访问的服务。

Run the following command to open ports that should be accessible on your server, such as port 22 for your SSH connection and port 80 for a conventional HTTP web server. If you use SSL on your web server, make sure to add port 443:

运行以下命令以打开服务器上应可访问的端口，例如SSH连接的端口22和常规HTTP Web服务器的端口80 。 如果您在Web服务器上使用SSL，请确保添加端口443 ：

The firewall_myservices option is set to a list of TCP ports or services, separated by spaces, that should be accessible on your server.

firewall_myservices选项设置为TCP端口或服务列表，以空格分隔，应在您的服务器上对其进行访问。

Note: You could also use services by name. The services that FreeBSD knows by name are listed in the /etc/services file. For instance, you could change the previous command to something like this:

注意：您也可以按名称使用服务。 FreeBSD按名称知道的服务列在/etc/services文件中。 例如，您可以将先前的命令更改为以下内容：

This would have the same results.

这将具有相同的结果。

The firewall_allowservices option lists items that should be allowed to access the provided services. Therefore it allows you to limit access to your exposed services (from firewall_myservices) to particular machines or network ranges. For example, this could be useful if you want a machine to host web content for an internal company network. The keyword "any" means that any IPs can access these services, making them completely public:

firewall_allowservices选项列出了应该允许访问提供的服务的项目。 因此，它允许您将对公开服务的访问(从firewall_myservices )限制为特定的计算机或网络范围。 例如，如果您希望一台机器为公司内部网络托管Web内容，这可能会很有用。 关键字"any"表示任何IP都可以访问这些服务，从而使其完全公开：

The firewall_logdeny option tells ipfw to log all connection attempts that are denied to a file located at /var/log/security. Run the following command to set this:

firewall_logdeny选项告诉ipfw将所有被拒绝的连接尝试记录到/var/log/security 。 运行以下命令进行设置：

To check on the changes you’ve made to the firewall configuration, run the following command:

要检查对防火墙配置所做的更改，请运行以下命令：

This portion of the /etc/rc.conf file will look like this:

/etc/rc.conf文件的这一部分将如下所示：

   

    Output
   
firewall_enable="YES"
firewall_quiet="YES"
firewall_type="workstation"
firewall_myservices="22 80 443"
firewall_allowservices="any"
firewall_logdeny="YES"

Remember to adjust the firewall_myservices option to reference the services you wish to expose to clients.

请记住要调整firewall_myservices选项以引用您希望向客户端公开的服务。

允许UDP连接(可选) (Allowing UDP Connections (Optional))

The ports and services listed in the firewall_myservices option in the /etc/rc.conf file allow access for TCP connections. If you have services that you wish to expose that use UDP, you need to edit the /etc/rc.firewall file:

/etc/rc.conf文件的firewall_myservices选项中列出的端口和服务允许访问TCP连接。 如果您希望使用UDP公开服务，则需要编辑/etc/rc.firewall文件：

You configured your firewall to use the "workstation" firewall type, so look for a section that looks like this:

您已将防火墙配置为使用"workstation"防火墙类型，因此请查找以下部分：

. . .

[Ww][Oo][Rr][Kk][Ss][Tt][Aa][Tt][Ii][Oo][Nn])

. . .

There is a section within this block that is dedicated to processing the firewall_allowservices and firewall_myservices values that you set. It will look like this:

此块中有一部分专门处理您设置的firewall_allowservices和firewall_myservices值。 它看起来像这样：

for i in ${firewall_allowservices} ; do
  for j in ${firewall_myservices} ; do
    ${fwcmd} add pass tcp from $i to me $j
  done
done

After this section, you can add any services or ports that should accept UDP packets by adding lines like this:

在本节之后，您可以通过添加以下行来添加应接受UDP数据包的所有服务或端口：

${fwcmd} add pass udp from any to me port_num

In vi, press i to switch to INSERT mode and add your content, then save and close the file by pressing ESC, typing :wq, and pressing ENTER. In the previous example, you can leave the "any" keyword if the connection should be allowed for all clients or change it to a specific IP address or network range. The port_num should be replaced by the port number or service name you wish to allow UDP access to. For example, if you’re running a DNS server, you may wish to have a line that looks something like this:

在vi ，按i键切换到INSERT模式并添加内容，然后按ESC ，键入:wq ，然后按ENTER ，保存并关闭文件。 在上一个示例中，如果应允许所有客户端进行连接，或者将其更改为特定的IP地址或网络范围，则可以保留"any"关键字。 port_num应该替换为您希望允许UDP访问的端口号或服务名称。 例如，如果您正在运行DNS服务器，则可能希望一行看起来像这样：

for i in ${firewall_allowservices} ; do
  for j in ${firewall_myservices} ; do
    ${fwcmd} add pass tcp from $i to me $j
  done
done

${fwcmd} add pass udp from 192.168.2.0/24 to me 53

This will allow any client from within the 192.168.2.0/24 network range to access a DNS server operating on the standard port 53. Note that in this example you would also want to open this port up for TCP connections as that is used by DNS servers for longer replies.

这将允许192.168.2.0/24网络范围内的任何客户端访问在标准端口53上运行的DNS服务器。 请注意，在此示例中，您还希望为TCP连接打开此端口，因为DNS服务器将其用于更长的答复。

Save and close the file when you are finished.

完成后保存并关闭文件。

启动防火墙 (Starting the Firewall)

When you are finished with your configuration, you can start the firewall by typing:

完成配置后，可以通过键入以下内容来启动防火墙：

The firewall will start correctly, blocking unwanted traffic while adhering to your allowed services and ports. This firewall will start automatically at every boot.

防火墙将正确启动，在遵守您允许的服务和端口的同时阻止不必要的流量。 此防火墙将在每次启动时自动启动。

You also want to configure a limit on how many denials per IP address you’ll log. This will prevent your logs from filling up from a single, persistent user. You can do this in the /etc/sysctl.conf file:

您还想配置一个限制，以限制您将记录的每个IP地址有多少个拒绝。 这将防止您的日志由单个永久用户填写。 您可以在/etc/sysctl.conf文件中执行此操作：

At the bottom of the file, you can limit your logging to "5" by adding the following line:

在文件的底部，您可以通过添加以下行来将日志记录限制为"5" ：

...
net.inet.ip.fw.verbose_limit=5

Save and close the file when you are finished. This will configure that setting on the next boot.

完成后保存并关闭文件。 这将在下次启动时配置该设置。

To implement this same behavior for your currently active session without restarting, you can use the sysctl command itself, like this:

要在当前活动的会话中实现相同的行为而无需重新启动，可以使用sysctl命令本身，如下所示：

This should immediately implement the limit for this boot.

这应该立即实现此引导的限制。

如何为您的服务器设置时区 (How To Set the Time Zone for Your Server)

It is a good idea to correctly set the time zone for your server. This is an important step for when you configure NTP time synchronization in the next section.

正确设置服务器的时区是一个好主意。 在下一节中配置NTP时间同步时，这是重要的步骤。

FreeBSD comes with a menu-based tool called tzsetup for configuring time zones. To set the time zone for your server, call this command with sudo privileges:

FreeBSD带有一个名为tzsetup的基于菜单的工具，用于配置时区。 要设置服务器的时区，请使用sudo权限调用此命令：

First, you will be asked to select the region of the world your server is located in:

首先，将要求您选择服务器所在的世界区域：

You will need to choose a sub-region or country next:

接下来，您需要选择一个子区域或国家：

Note: To navigate these menus, you’ll need to use the PAGE UP and PAGE DOWN keys. If you do not have these on your keyboard, you can use FN + DOWN or FN + UP.

注意：要浏览这些菜单，您需要使用PAGE UP和PAGE DOWN键。 如果您的键盘上没有这些，则可以使用FN + DOWN或FN + UP 。

Finally, select the specific time zone that is appropriate for your server:

最后，选择适合您服务器的特定时区：

Confirm the time zone selection that is presented based on your choices.

确认根据您的选择显示的时区选择。

At this point, your server’s time zone should match the selections you made.

此时，服务器的时区应与您所做的选择匹配。

如何配置NTP以保持准确的时间 (How To Configure NTP to Keep Accurate Time)

Now that you have the time zone configured on your server, you can set up NTP, or Network Time Protocol. This will help keep your server’s time in sync with others throughout the world. This is important for time-sensitive client-server interactions as well as accurate logging.

现在您已经在服务器上配置了时区，现在可以设置NTP或网络时间协议。 这将有助于使您服务器的时间与世界其他服务器保持同步。 这对于时间敏感的客户端-服务器交互以及准确的日志记录非常重要。

Again, you can enable the NTP service on your server by adjusting the /etc/rc.conf file. Run the following command to add the line ntpd_enable="YES" to the file:

同样，您可以通过调整/etc/rc.conf文件在服务器上启用NTP服务。 运行以下命令以将ntpd_enable="YES"行添加到文件中：

You also need to add a second line that will sync the time on your machine with the remote NTP servers at boot. This is necessary because it allows your server to exceed the normal drift limit on initialization. Your server will likely be outside of the drift limit at boot because your time zone will be applied prior to the NTP daemon starting, which will offset your system time:

您还需要添加第二行，以便在启动时将计算机上的时间与远程NTP服务器同步。 这是必需的，因为它允许您的服务器超过初始化时的正常漂移限制。 您的服务器可能在启动时超出了漂移限制，因为您的时区将在NTP守护程序启动之前应用，这将抵消您的系统时间：

If you did not have this line, your NTP daemon would fail when started due to the timezone settings that skew your system time prior in the boot process.

如果没有此行，由于时区设置会使引导过程之前的系统时间不正确，因此启动时NTP守护程序将失败。

You can start your ntpd service by typing:

您可以通过键入以下内容来启动ntpd服务：

This will maintain your server’s time by synchronizing with the NTP servers listed in /etc/ntp.conf.

通过与/etc/ntp.conf列出的NTP服务器同步，可以维护服务器的时间。

如何配置额外的交换空间 (How To Configure Extra Swap Space)

On FreeBSD servers configured on DigitalOcean, 1 Gigabyte of swap space is automatically configured regardless of the size of your server. You can see this by typing:

在DigitalOcean上配置的FreeBSD服务器上，无论服务器大小如何，都会自动配置1 GB的交换空间 。 您可以通过键入以下内容来查看：

It should show something like this:

它应该显示如下内容：

   

    Output
   
Device          1G-blocks     Used    Avail Capacity
/dev/gpt/swapfs         1        0        1     0%

Some users and applications may need more swap space than this. This is accomplished by adding a swap file.

一些用户和应用程序可能需要更多的交换空间。 这可以通过添加交换文件来完成。

The first thing you need to do is to allocate a chunk of the filesystem for the file you want to use for swap. You’ll use the truncate command, which can quickly allocate space on the fly.

您需要做的第一件事是为要用于交换的文件分配一部分文件系统。 您将使用truncate命令，该命令可以快速动态分配空间。

We’ll put the swapfile in /swapfile for this tutorial but you can put the file anywhere you wish, like /var/swapfile for example. This file will provide an additional 1 Gigabyte of swap space. You can adjust this number by modifying the value given to the -s option:

在本教程中，我们会将交换文件放在/swapfile ，但是您可以将文件放置在所需的任何位置，例如/var/swapfile 。 该文件将提供额外的1 GB交换空间。 您可以通过修改-s选项的值来调整此数字：

After you allocate the space, you need to lock down access to the file. Normal users should not have any access to the file:

分配空间后，需要锁定对文件的访问。 普通用户不应对该文件具有任何访问权限：

Next, associate a pseudo-device with your file and configure it to mount at boot by typing:

接下来，将伪设备与文件关联，并通过键入以下内容将其配置为在引导时挂载：

This command adds a line that looks like this to the /etc/fstab file:

此命令将以下行添加到/etc/fstab文件中：

md99 none swap sw,file=/swapfile,late 0 0

After the line is added to your /etc/fstab file, you can activate the swap file for the session by typing:

将行添加到/etc/fstab文件后，可以通过键入以下命令激活会话的交换文件：

You can verify that the swap file is now working by using the swapinfo command again:

您可以再次使用swapinfo命令来验证交换文件现在是否正常工作：

You should see the additional device (/dev/md99) associated with your swap file:

您应该看到与交换文件关联的其他设备( /dev/md99 )：

   

    Output
   
Device          1G-blocks     Used    Avail Capacity
/dev/gpt/swapfs         1        0        1     0%
/dev/md99               1        0        1     0%
Total                   2        0        2     0%

This swap file will be mounted automatically at each boot.

该交换文件将在每次引导时自动安装。

结论 (Conclusion)

The steps outlined in this guide can be used to bring your FreeBSD server into a more production-ready state. By configuring basic essentials like a firewall, NTP synchronization, and appropriate swap space, your server can be used as a good base for future installations and services.

本指南中概述的步骤可用于使FreeBSD服务器进入生产就绪状态。 通过配置防火墙，NTP同步和适当的交换空间等基本要素，您的服务器可以用作将来安装和服务的良好基础。

翻译自: https://www.digitalocean.com/community/tutorials/recommended-steps-for-new-freebsd-12-0-servers

freebsd 9.1.1