FreeBSD SSH Hardening
gist.github.com
FreeBSD SSH Hardening
1–10 of 121 posts
Re: FreeBSD SSH Hardening
#2I always heard that FreeBSD has unparalleled networking
Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
Re: FreeBSD SSH Hardening
#3I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
[deleted]
Re: FreeBSD SSH Hardening
#4I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
I don't think it would be worthwhile.
If you want better latency and throughput, you wouldn't be using the kernel network stack and instead be opting for some userspace networking stack like DPDK or onload.
Depends obviously on what the bottlenecks of your application are, your NIC and the characteristics of your hardware as well.
Re: FreeBSD SSH Hardening
#5I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
I don't think it would be worthwhile. If you want better latency and throughput, you wouldn't be using the kernel network stack and instead be opting for some userspace networking stack like DPDK or onload. Depends obviously on what the bottlenecks of your application are, your NIC and the characteristics of your hardware as well.
FreeBSD has netmap for fast userspace packet processing.
Re: FreeBSD SSH Hardening
#6I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
I don't think it would be worthwhile. If you want better latency and throughput, you wouldn't be using the kernel network stack and instead be opting for some userspace networking stack like DPDK or onload. Depends obviously on what the bottlenecks of your application are, your NIC and the characteristics of your hardware as well.
I loved the simple explanation :)
Re: FreeBSD SSH Hardening
#7I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)
As with all things, you would really need to benchmark the system, preferably with real load, both ways to know for sure. But that takes a lot of time, especially if you're going to put in the time to tweak both systems.
People can do amazing stuff with enough time in both FreeBSD and Linux. I honestly think most server applications wouldn't be held back by either OS. You need your application to be really lightweight and focused before the OS makes a big difference, and even then, the differences only show if you're maxing out the hardware.
I worked at WhatsApp, and enjoyed working with FreeBSD there, and clearly it worked for us. Linux in FB datacenters also worked, but the server components were a lot different so there was never an apples to apples comparison. I run FreeBSD on my personal servers because I enjoyed working with it at Yahoo and then WhatsApp; but my personal servers don't have any performance needs. Sure, the networking stuff is nice (and it was nice to work with in the kernel), but what I like most about FreeBSD is the lack of churn. I can look at old administrative recipies and all the commands still work. I can expect (and mostly get) that when I upgrade, everything will keep working, and maybe a little better; occassionally, a lot better.
Re: FreeBSD SSH Hardening
#8Relevant: If your SSH server is public, you can give its address to https://sshcheck.com/ and it will report any weak spots in your config.
Re: FreeBSD SSH Hardening
#9The first thing i do on a new remote box is to move SSH to another non-standard port other than 22. I use the same port for every remote boxes I have. Then add that port into `.ssh/config` on local box.
Second is to disable root login.
Third is to copy my private key over and disable password login.
3 essential steps to secure SSH.
Re: FreeBSD SSH Hardening
#10It generates a new RSA key but disables it in the config? Seems a bit much mindless cut and paste.