HardenedBSD

HardenedBSD: A Security-Enhanced Fork of FreeBSDs

A security-enhanced fork of FreeBSD with additional exploit mitigations like Address Space Layout Randomization and Control Flow Guard, designed for hostile environments.

What is HardenedBSD?

HardenedBSD is a security-enhanced operating system based on FreeBSD. It incorporates a number of additional security and exploit mitigation features that are not found in the base FreeBSD distribution.

Some of the key security features of HardenedBSD include:

• Address Space Layout Randomization (ASLR) - Randomizes the location of key data areas in memory to make it harder for attackers to target them.
• Control Flow Guard (CFG) - Protects indirect calls to help prevent attackers from hijacking program control flow.
• Per-page kernel NX/XD - Prevents execution of buffer overflow attacks targeting the kernel.
• SELinux support - Allows implementation of strict mandatory access control to restrict what processes can access resources.
• Procfs hardening - Restricts information leakage from /proc to unprivileged users.

The HardenedBSD project focuses specifically on enhancements that increase the security of FreeBSD, particularly in server and network-facing deployment scenarios. It incorporates patches from grsecurity and PaX to implement many of its security features.

The project follows FreeBSD's philosophy of stability and rock-solid reliability. It aims to achieve a higher level of security without compromising on FreeBSD's qualities of performance, extensive software support, and management tools.

In summary, HardenedBSD brings additional mitigation technologies, access restrictions, and exploit prevention capabilities to FreeBSD. It hardens FreeBSD against attacks targeting servers, appliances, network infrastructure, firewalls, and other hostile deployment environments.

HardenedBSD Features

Official Links