Cara mount ISO mudah kok , berikut langkah-langkahnya :

mdconfig -a -t vnode -f [ISO filename]
mount -t cd9660 /dev/md? [mount destination]

untuk menghilangkan lagi :

umount [mount destination]
mdconfig -d -u /dev/md?

eh kalau yang udah pake Gnome ada juga lho aplikasi yang untuk mount ISo image pake aja Furius ISO Mount.

Dah yah selamat mencoba

Source : http://tunggul.staff.uns.ac.id/2008/10/06/mount-iso-image-di-freebsd/

Bruteblock memungkinkan sistem administrator untuk memblokir berbagai serangan bruteforce pada Service UNIX . Sistem kerja Program menganalisa sistem log dan menambahkan alamat IP penyerang ke ipfw2 tabel, sehingga secara efektif memblokir mereka.

Alamat IP secara otomatis akan dihapus dari tabel setelah rentang waktu tertentu yang sudah ditetapkan. Bruteblock menggunakan ekspresi reguler untuk parse log, yang memberikan fleksibilitas mengoperasikannya bisa digunakan untuk hampir semua service jaringan.

Langkah instalasi sangat mudah :
1. install melalui port :

#cd /usr/ports/security/bruteblock
#make install clean

2. Tambahkan baris berikut di /etc/rc.conf agar bruteblock bisa langsung running sewaktu boot

bruteblockd_enable=”YES”
bruteblockd_table=”1″
bruteblockd_flags=”-s 5″

3. Edit file /etc/syslog.conf

Ubah baris berikut :

auth.info;authpriv.info                                /var/log/auth.log

menjadi

auth.info;authpriv.info                         |exec /usr/local/sbin/bruteblock -f /usr/local/etc/bruteblock/ssh.conf

4. Restart Syslogd

#/etc/rc.d/syslogd restart

5. Jalankan aplikasi bruteblock dengan perintah :

#/usr/local/etc/rc.d/bruteblockd.sh start

6. Tambahkan setting di ipfw untuk memblock IP-IP yang di masukkan oleh bruteblock

#ipfw add 400 deny ip from me to table\(1\)
#ipfw add 410 deny ip from table\(1\) to me

7. Untuk mengubah setting bruteblock untuk setiap service yang dilindungi, misal saya akan mengubah setting untuk ssh ada di file /usr/local/etc/bruteblock/ssh.conf
beberapa point yang penting di bagian setting ini adalah :

regexp          = sshd.*Illegal user \S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
regexp1         = sshd.*Failed password for (?:illegal user )?\S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

# Number of failed login attempts within time before we block

max_count       = 4

# Time in seconds in which all failed login attempts must occur

within_time     = 60

# Time in seconds to block ip in firewall

# 10 minutes

reset_ip       = 600

# IPFW table number to add “bad” hosts

ipfw2_table_no = 1

kita bisa saja menerapkan untuk service lain , misal ftp. kita hanya perlu mengubah di bagian regexp. disesuaikan dengan format log servicenya.

moga bermanfaat
Source : http://tunggul.staff.uns.ac.id/2008/11/21/amankan-freebsd-dari-serangan-bruteforce/

Filesystem Size Used Avail Capacity Mounted on

/dev/ad4s1a 9.7G 77M 8.8G 1%
/devfs 1.0K 1.0K 0B 100% /dev
/dev/ad4s1e 5.8G 4.0K 5.3G 0% /cache0
/dev/ad4s1f 5.8G 4.0K 5.3G 0% /cache1
/dev/ad4s1g 5.8G 4.0K 5.3G 0% /cache2
/dev/ad4s1h 70G 1.5G 62G 2% /usr
/dev/ad4s1d 9.7G 22M 8.9G 0% /var

Sebelumnya jangan lupa ketika membuat partisinya, flag bootable nya di berikan, saya sempai ngulang install 3 kali karena lupa

lalu install dengan pilihan standart dan ikuti pihan-pilihan sesuai dengan kita

Setelah selesai instalasi, permasalahan pertama saya adalah, saya tidak bisa ssh ke freebsd, memakai putty, tapi setelah bertanya bang Google, yang di lakukan hanya mengedit file /etc/ssh/sshd_config

line :

#PermitRootLogin no

dirubah :

PermitRootLogin yes

Setelah itu mulah lah ke tahap optimalisasi freebsd yang kita instalkan, yaitu menginstall aplikasi~ pendukung yang kita butuhkan dan mngeupdate port port freebsd. apa itu ports ? ports merupakan kontribusi aplikasi.
Koleksi FreeBSD ports menawarkan cara yang simpel bagi pengguna dan administrator untuk menginstall aplikasi. setiap port berisi patch patch untuk aplikasi orsinil dan jalan di BSD. Cara kompile sebuah aplikasi sangatlah mudah dengan mengetikan make build pada port directory. Makefile secara otomatis mendownload source code aplikasi, mem patch nya dan mengcompile nya.

Dengan menggunakan perintah CVSup, kita dapat mengupdate port port terkini
pertama yang saya lakukan adalah mengambil pakcet dan menginstall CVSup dengan :

freebsd> pkg_add -r cvsup-without-gui

lalu menjalankannya dengan mengeksekusi file ports-supfile yang berada di :

freebsd> /usr/share/examples/cvsup/ports-supfile

copy terdahulu file tersebut ke dir /root :

freebsd> cp /usr/share/examples/cvsup/ports-supfile /root/

edit ports-supfile, ganti CHANGE_THIS.FreeBSD.org dengan kebutuhan, lalu jalankan :

freebs> cvsup -L 2 /root/ports-supfile

Setelah itu saya melakukan Compile kernel FreeBSD agar squid dapat berjalan dengan langkah :

Compile dan install kernel biasanya dilakukan bila kita menambahkan hardware baru atau saat menginstalasi software tertentu yang membutuhkan penyesuaian pada kernel. Pertama cek dulu apakah sudah ada source kernel FreeBSD nya, yaitu dalam usr/src/sys yang berisi berbagai sub-direktori yang merupakan bagian-bagian dari kernel.

freebsd> cd /usr/src/sys/i386/conf/

backup dulu file konfigurasi kernel nya :

freebsd /usr/src/sys/i386/conf > cp GENERIC KERNELBARU

Kemudian Edit file konfigurasi KERNELBARU sesuai kebutuhan, Jangan lupa mengganti baris “ident” dari GENERIC menjadi KERNELBARU (sesuaikan dengan nama file konfigurasinya).

OPTION yang di tambah kan untuk menjalankan squid :

options SYSVMSG
options MSGMNB=16384
options MSGMNI=41
options MSGSEG=2049
options MSGSSZ=64
options MSGTQL=512
options SYSVSHM
options SHMSEG=16
options SHMMNI=128
options SHMMAX=1073741824
options SHMALL=16384

Setelah itu :

freebsd /usr/src/sys/i386/conf > config KERNELBARU
freebsd /usr/src/sys/i386/conf > cd ../../compile/KERNELBARU
freebsd /usr/src/sys/compile/KERNELBARU > make depend
freebsd /usr/src/sys/compile/KERNELBARU > make
freebsd /usr/src/sys/compile/KERNELBARU > make install

Install selesai, reboot system.

Setelah System FreeBSD kita telah selesai di installasi, Kompile kernel telah kita lakukan, mulai lah kita ke tahap menginstalkan squid ke server. Squid yang aku pergunakan adalah squid-2.6.STABLE7, anda mencari source nya dimana saja.

Buat group dan user yang akan di gunakan untuk menjalankan squid :

freebsd> pw group add squid -g 100
freebsd> pw user add squid -u 100 -g squid -s /usr/sbin/nologin -d /usr/local/squid
freebsd> chown -Rv squid:squid /cache0 /cache1 /cache2

cache0, 1 dan 2 merukan direktori cache yang telah kita tentukan

laly masuklah ke direktory squid yang telah kita extrak, dan mulai lah kita menginstall nya :

freebsd> cd /usr/local/src/
freebsd /usr/local/src > tar zxf /root/squid-2.6.STABLE9.tar.bz
freebsd /usr/local/src > ./configure –prefix=/usr/local/squid \
–enable-pf-transparent \
–enable-storeio=aufs \
–enable-removal-policies=heap \
–enable-delay-pools \
–disable-wccp \
–enable-cache-digests \
–enable-default-err-languages=English \
–enable-err-languages=English \
–disable-ident-lookups \
–disable-hostname-checks \
–enable-underscores \
–enable-snmp \
–enable-useragent-log \
–disable-wccpv2 \
–disable-wccp \
–disable-internal-dns \
–enable-htcp

freebsd /usr/local/src > make all
freebsd /usr/local/src > make install

Setelah itu edit lah squid.conf sesuai dengan kebutuhan

freebsd> ee /usr/local/squid/etc/squid.conf

cek terlebih dahylu konfigurasi nya dengan perintah :

freebsd> /usr/local/squid/sbin/squid -k parse

setelah dirasa cukup, jalan kan squid :

freebsd> /usr/local/squid/sbin/squid -sYD

dan untuk menjalankan perubahan config, dapat dengan perintah

freebsd> /usr/local/squid/sbin/squid -k reconfigure

CACHE MANAGER

If you want to use the WWW interface to the Cache Manager, copy
the cachemgr.cgi program into your httpd server’s cgi-bin
directory.

Source : http://goldennetbiaro.com/index.php?option=com_content&view=article&id=63:installasi-freebsd-compile-kernel-dan-squid&catid=50:freebsd&Itemid=60

WP-Syntax Editor Integration Plugin
WP-Syntax

Contoh Hasilnya lebih kurang seperti dibawah ini:

<td style="background: #ccf; text-align: center;"><b>This article is part of</b>
<p><b>the <strong class="selflink">JavaScript</strong> series.</b></p>
</td>
</tr>
<tr>
<td style="text-align: center;"><strong class="selflink">JavaScript</strong></td>
</tr>
<tr>
<td style="text-align: center;"><a href="/wiki/JavaScript_syntax" title="JavaScript syntax">JavaScript syntax</a></td>
</tr>
<tr>
<td style="text-align: center;"><a href="/wiki/Category:JavaScript_programming_language" title="Category:JavaScript programming language">JavaScript topics</a></td>
</tr>
<tr>
<td style="text-align: center;">
<div class="noprint plainlinks navbar" style="background:none; padding:0; font-weight:normal;; font-size:xx-small;">This box: <a href="/wiki/Template:JavaScriptSidebar" title="Template:JavaScriptSidebar"><span title="View this template" style="">view</span></a> <span style="font-size:80%;">•</span> <a href="/wiki/Template_talk:JavaScriptSidebar" title="Template talk:JavaScriptSidebar"><span title="Discuss this template" style="">talk</span></a> <span style="font-size:80%;">•</span> <a href="http://en.wikipedia.org/w/index.php?title=Template:JavaScriptSidebar&amp;action=edit" class="external text" rel="nofollow"><span title="Edit this template" style=";">edit</span></a></div>
</td>

Mudah2an bermanfaat.

usbd_enable="NO"
background_fsck="NO"
update_motd="NO"
syslogd_flags="-ss"
accounting_enable="YES"
clear_tmp_enable="YES"
nfs_reserved_port_only="YES"

Edit file /boot/loader.conf, tambahkan baris berikut :
autoboot_delay="3"
kern.ipc.maxsockets=16384

Edit file /etc/sysctl.conf, tambahkan baris berikut :
security.bsd.see_other_uids=0
net.inet.tcp.sendspace=65536
net.inet.tcp.recvspace=65536
kern.ipc.somaxconn=2048
net.inet.icmp.drop_redirect=1
net.inet.icmp.log_redirect=0
net.inet.ip.redirect=0
kern.maxfiles=112328
kern.maxfilesperproc=31095
net.inet.tcp.blackhole=1
net.inet.udp.blackhole=1
net.inet.icmp.icmplim_output=0
net.inet.tcp.msl=3000
vfs.read_max=64
vfs.lorunningspace=6291456
vfs.hirunningspace=12388608
vfs.ufs.dirhash_maxmem=38554432

Aktifkan seluruh konfigurasi dengan me-reboot mesin :
server# reboot

Source Aslinya : http://www.devilian.net/2009/09/optimasi-server-freebsd/

Lama-lama saya jadi jatuh cintrong juga nih ma “BSD Family” ternyata segala sesuatunya sangat mudah digunakan, update aplikasi, check Vulnerability, semua sudah ada utilitinya tinggal one command saja, duhh…jadi ngegemesinn nih…si “Setan Merah” hahaha…

Portmanager is an FreeBSD utility that automates the process of upgrading and managing installed FreeBSD ports without or almost without user intervention when updating. Portmanager ensures that FreeBSD installed ports accurately reflect and update as of those available in the ports tree.

To use portmanager, the FreeBSD ports collection tree needs to be updated with CVSup or Portsnap.

If your system hasn’t have portmanager installed, portmanager can be found at /usr/ports/sysutils/portmanager. Just go to the directory and run “make install clean” to install it.

To check the status of all ports and ports’ dependencies installed on your system:

portmanager -s

To update all ports installed to up to date with your ports tree:

portmanager -u

Meanwhile, portaudit is a utility that checks the installed ports against a database of published security vulnerabilities to ensure the security of the system is not compromised.

To install portaudit, use the following commands:

To install the port: cd /usr/ports/security/portaudit/ && make install clean
To add the package: pkg_add -r portaudit

After installation, portaudit will fetch and update the security database automatically and include its reports in the output of the FreeBSD daily security run. Beside, before any ports installation or update, portaudit will check the ports’ versions against any vulnerabilities and alerts you if there any security implications.

With portmanager and portaudit, the installed ports and applications in FreeBSD system can be updated easily and ensured of always free of security holes.

Source : http://www.mydigitallife.info/2006/04/14/update-freebsd-ports-collection-to-latest-version-with-security-update-with-portmanager-and-portaudit/

FreeBSD…masihkah perlu diragukan ?

Source : http://handaru.blogsome.com/2008/01/01/menambah-hard-disk-baru-di-freebsd-62/

1) If this is your first time recompiling your kernel I suggest you reading my tutorials on cvsup. While it is not necessary if you upgrade your system laster these settings could be removed during a upgrade.

We are now going to build a custom kernel with some basic firewall options.

host# cd /usr/src/sys/i386/conf
host# cp GENERIC FIREWALL

Add the following lines to the new custom kernel called FIREWALL

host# ee FIREWALL
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=15

Now we are going to compile the new kernel

host# cd /usr/src
host# make kernel KERNCONF=FIREWALL

2) Now we are going to tell the system to start the firewall on boot and where the firewall rules are located.

host# ee /etc/rc.conf
firewall_enable=”YES”
firewall_type=”/usr/local/etc/firewall.rules”
firewall_flags=”-p cpp”

3) Now we need to create the firewall.rules file. I have attached a sample file you could use as a start. If you want to see what you have open right now run this command and modify to make your own firewall.rules file.

host# sockstat -4

If you are using my sample firewall.rules.txt file just download and open in your favorite text editor. Then copy that into the next command.

host# ee /usr/local/etc/firewall.rules
host# shutdown -r now

Check to make sure ipfw is working

host# ipfw -list

SAMPLE

/** set these to your outside interface network and netmask and ip **/
#define oif  rl0
#define oip  1.1.1.1
#define onet 1.1.1.1:255.255.252.0

/** Un-welcome address **/
#define badsite1    194.251.240.105:255.255.255.0
#define badsite2    24.112.239.158
#define badsite3    209.247.40.170:255.255.255.0
#define badsite4    195.230.153.1:255.255.255.0
#define badsite5    194.183.177.1:255.255.255.0
#define badsite6    61.9.189.48:255.255.255.0
#define badsite7    213.243.178.226:255.255.255.0
#define badsite8    217.5.72.84
#define badsite9    61.116.112.177
#define badsitea    193.231.15.134
#define badsiteb    217.0.149.105:255.255.255.0
#define badsitec    61.216.62.200
#define badsited    203.231.153.180
#define badsitee    66.21.192.41
#define badsitef    61.209.170.123
#define badsiteg    61.216.61.192
#define badsiteh    152.81.1.137
#define badsitei    128.244.34.216

/** @home operators **/
#define scansite1   24.0.0.203:255.255.255.0
#define scansite2   24.0.94.130:255.255.255.0
#define scansite3   24.0.24.51:255.255.255.0
#define scansite4   24.0.16.94:255.255.255.0
#define scansite5   24.112.31.170:255.255.255.0
#define scansite6   24.112.32.106
#define scansite7   66.185.84.200:255.255.255.0

/** drop Un-welcome address **/
add deny log all from badsite1 to any
add deny log all from badsite2 to any
add deny log all from badsite3 to any
add deny log all from badsite4 to any
add deny log all from badsite5 to any
add deny log all from badsite6 to any
add deny log all from badsite7 to any
add deny log all from badsite8 to any
add deny log all from badsite9 to any
add deny log all from badsitea to any
add deny log all from badsiteb to any
add deny log all from badsitec to any
add deny log all from badsited to any
add deny log all from badsitee to any
add deny log all from badsitef to any
add deny log all from badsiteg to any
add deny log all from badsiteh to any
add deny log all from badsitei to any

/** Deny scanning address **/
add deny log all from scansite1 to any in via oif
add deny log all from scansite2 to any in via oif
add deny log all from scansite3 to any in via oif
add deny log all from scansite4 to any in via oif
add deny log all from scansite5 to any in via oif
add deny log all from scansite6 to any in via oif
add deny log all from scansite7 to any in via oif

/** Deny @home network broadcast **/
add deny all from any to 255.255.255.255 in via oif
add deny all from any to 24.255.255.255 in via oif
add deny all from any to 100.100.100.0/24 in via oif

/** Stop spoofing **/
add deny log all from onet to any in via iif
add deny log all from oip to any in via oif

/** Stop RFC1918 nets on the outside interface **/
add deny all from any to 10.0.0.0/8 via oif
add deny all from any to 172.16.0.0/12 via oif
add deny all from any to 192.168.0.0/16 via oif

/**
Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
on the outside interface
**/
add deny all from any to 0.0.0.0/8 via oif
add deny all from any to 169.254.0.0/16 via oif
add deny all from any to 192.0.2.0/24 via oif
add deny all from any to 224.0.0.0/4 via oif
add deny all from any to 240.0.0.0/4 via oif

/** Stop RFC1918 nets on the outside interface **/
add deny all from 10.0.0.0/8 to any via oif
add deny all from 172.16.0.0/12 to any via oif
add deny all from 192.168.0.0/16 to any via oif

/**
Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
on the outside interface
**/
add deny all from 0.0.0.0/8 to any via oif
add deny all from 169.254.0.0/16 to any via oif
add deny all from 192.0.2.0/24 to any via oif
add deny all from 224.0.0.0/4 to any via oif
add deny all from 240.0.0.0/4 to any via oif

/************************/
/** Check dynamic rule
/************************/
add check-state

/** Allow TCP through if setup succeeded **/
add allow tcp from any to any established

/** Allow IP fragments to allow through **/
add allow all from any to any frag

/************************/
/** Check dynamic rule
/************************/
add check-state

/** Allow TCP through if setup succeeded **/
add allow tcp from any to any established

/** Allow IP fragments to allow through **/
add allow all from any to any frag

/** Allow setup of SMTP **/
add allow tcp from any to oip 25 setup

/** Allow setup of POP3 **/
add allow tcp from any to oip 110 setup

/** Allow setup of IMAP4 **/
add allow tcp from any to oip 143 setup

/** Allow setup of ssh **/
add allow tcp from any to oip 22 setup

/** Allow setup of HTTP **/
add allow tcp from any to oip 80,443 setup

/** Allow setup of DirectAdmin **/
add allow tcp from any to oip 2222 setup

/** Allow setup of FTP **/
add allow tcp from any to oip 20,21 setup

/** Allow setup of FTP PASSIVE **/
add allow tcp from any to oip 49152-65534 setup

/** Reject and Log all setup of incoming connections from the outside **/
add deny log tcp from any to any in via oif setup

/** Allow setup of any other TCP connection **/
add allow tcp from any to any setup

/**************************/
/** Allow UDP to outside
/**************************/
add pass udp from me to any 53 keep-state
add pass udp from any to me 53

add allow udp from oip to any out via oif keep-state

/**************************/
/** Allow ping to outside
/**************************/
add allow icmp from oip to any out via oif icmptypes 8 keep-state

/*******************************/
/** Log all unrecognize attempt
/*******************************/
add deny all from any to not oip in via oif
add deny log all from any to any