From abcf528284ccb4cba8875da578237ace5f6d82db Mon Sep 17 00:00:00 2001 From: "(system)" <(system)@OPNsense.localdomain> Date: Fri, 7 Feb 2025 12:44:44 +0100 Subject: [PATCH] /usr/local/opnsense/mvc/script/run_migrations.php made changes @ 2025-02-07T12:31:55.441500 ((system)) --- config.xml | 206 ++++++++++++++++++++++++++++------------------------- 1 file changed, 109 insertions(+), 97 deletions(-) diff --git a/config.xml b/config.xml index 08ca095..f388d8b 100644 --- a/config.xml +++ b/config.xml @@ -1,203 +1,203 @@ opnsense - - - Increase UFS read-ahead speeds to match the state of hard drives and NCQ. + + vfs.read_max default + Increase UFS read-ahead speeds to match the state of hard drives and NCQ. - - Set the ephemeral port range to be lower. + net.inet.ip.portrange.first default + Set the ephemeral port range to be lower. - - Drop packets to closed TCP ports without returning a RST + net.inet.tcp.blackhole default + Drop packets to closed TCP ports without returning a RST - - Do not send ICMP port unreachable messages for closed UDP ports + net.inet.udp.blackhole default + Do not send ICMP port unreachable messages for closed UDP ports - - Randomize the ID field in IP packets + net.inet.ip.random_id default + Randomize the ID field in IP packets - - - Source routing is another way for an attacker to try to reach non-routable addresses behind your box. - It can also be used to probe for information about your internal networks. These functions come enabled - as part of the standard FreeBSD core system. - + net.inet.ip.sourceroute default - - Source routing is another way for an attacker to try to reach non-routable addresses behind your box. It can also be used to probe for information about your internal networks. These functions come enabled as part of the standard FreeBSD core system. + + net.inet.ip.accept_sourceroute default + + Source routing is another way for an attacker to try to reach non-routable addresses behind your box. + It can also be used to probe for information about your internal networks. These functions come enabled + as part of the standard FreeBSD core system. + - + + net.inet.icmp.log_redirect + default This option turns off the logging of redirect packets because there is no limit and this could fill up your logs consuming your whole hard drive. - net.inet.icmp.log_redirect - default - - Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) + net.inet.tcp.drop_synfin default + Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) - - Enable sending IPv6 redirects + net.inet6.ip6.redirect default + Enable sending IPv6 redirects - - Enable privacy settings for IPv6 (RFC 4941) + net.inet6.ip6.use_tempaddr default + Enable privacy settings for IPv6 (RFC 4941) - - Prefer privacy addresses and use them over the normal addresses + net.inet6.ip6.prefer_tempaddr default + Prefer privacy addresses and use them over the normal addresses - - Generate SYN cookies for outbound SYN-ACK packets + net.inet.tcp.syncookies default + Generate SYN cookies for outbound SYN-ACK packets - - Maximum incoming/outgoing TCP datagram size (receive) + net.inet.tcp.recvspace default + Maximum incoming/outgoing TCP datagram size (receive) - - Maximum incoming/outgoing TCP datagram size (send) + net.inet.tcp.sendspace default + Maximum incoming/outgoing TCP datagram size (send) - - Do not delay ACK to try and piggyback it onto a data packet + net.inet.tcp.delayed_ack default + Do not delay ACK to try and piggyback it onto a data packet - - Maximum outgoing UDP datagram size + net.inet.udp.maxdgram default + Maximum outgoing UDP datagram size - - Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) + net.link.bridge.pfil_onlyip default + Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) - - Set to 1 to additionally filter on the physical interface for locally destined packets + net.link.bridge.pfil_local_phys default + Set to 1 to additionally filter on the physical interface for locally destined packets - - Set to 0 to disable filtering on the incoming and outgoing member interfaces. + net.link.bridge.pfil_member default + Set to 0 to disable filtering on the incoming and outgoing member interfaces. - - Set to 1 to enable filtering on the bridge interface + net.link.bridge.pfil_bridge default + Set to 1 to enable filtering on the bridge interface - - Allow unprivileged access to tap(4) device nodes + net.link.tap.user_open default + Allow unprivileged access to tap(4) device nodes - - Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) + kern.randompid default + Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) - - Disable CTRL+ALT+Delete reboot from keyboard. + hw.syscons.kbd_reboot default + Disable CTRL+ALT+Delete reboot from keyboard. - - Enable TCP extended debugging + net.inet.tcp.log_debug default + Enable TCP extended debugging - - Set ICMP Limits + net.inet.icmp.icmplim default + Set ICMP Limits - - TCP Offload Engine + net.inet.tcp.tso default + TCP Offload Engine - - UDP Checksums + net.inet.udp.checksum default + UDP Checksums - - Maximum socket buffer size + kern.ipc.maxsockbuf default + Maximum socket buffer size - - Page Table Isolation (Meltdown mitigation, requires reboot.) + vm.pmap.pti default + Page Table Isolation (Meltdown mitigation, requires reboot.) - - Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation) + hw.ibrs_disable default + Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation) - - Hide processes running as other groups + security.bsd.see_other_gids default + Hide processes running as other groups - - Hide processes running as other users + security.bsd.see_other_uids default + Hide processes running as other users - + + net.inet.ip.redirect + default Enable/disable sending of ICMP redirects in response to IP packets for which a better, and for the sender directly reachable, route and next hop is known. - net.inet.ip.redirect - default - + + net.inet.icmp.drop_redirect + 1 Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect packets without returning a response. - net.inet.icmp.drop_redirect - 1 - - Maximum outgoing UDP datagram size + net.local.dgram.maxdgram default + Maximum outgoing UDP datagram size @@ -205,21 +205,32 @@ OPNsense localdomain 1 - - admins - System Administrators - system + 1999 - 0 - page-all - - - root - System Administrator + admins system - admins - $2y$11$F5yOtLTn8aI21fKZTdsnueJjedH0PXTTPpD89Ha6ps3VfC/Ixgojq + System Administrators + page-all + 0 + + 0 + root + 0 + system + + + + + $2y$11$F5yOtLTn8aI21fKZTdsnueJjedH0PXTTPpD89Ha6ps3VfC/Ixgojq + + + + + + + System Administrator + 2000 2000 @@ -1008,9 +1019,9 @@ opt2 - root@192.168.10.103 - - /system_advanced_admin.php made changes + (system) + /usr/local/opnsense/mvc/script/run_migrations.php made changes + @@ -1298,7 +1309,7 @@ 8000 - + 0 @@ -1800,13 +1811,14 @@ Load - + 0 0 1400 + 0