Security

SEC-01 // SECURITY

Full-Disk Encryption

omfreebdy supports GELI full-disk encryption at install time. GELI encrypts the ZFS pool at the block device level before the OS boots.

See the FreeBSD Handbook — GELI for setup details.

GELI encryption is configured during installation. It cannot be added to an existing unencrypted pool without reinstalling.

Firewall

omfreebdy uses pf as the packet filter.

# Check firewall status
service pf status

# Reload rules after editing
service pf reload

Rules are in /etc/pf.conf. A minimal default configuration:

# Block all inbound, allow all outbound
block in all
pass out all keep state

# Allow established connections
pass in proto tcp from any to any flags S/SA keep state

Enable at boot:

sysrc pf_enable=YES
service pf start

Package Verification

Audit installed packages for known vulnerabilities:

# Check for security advisories
pkg audit -F

# Verify package checksums
pkg check --checksums

Run pkg audit regularly or after installing new software.

Sandboxing Untrusted Apps

Use sandbox to run untrusted applications in a disposable ZFS-backed FreeBSD jail:

sandbox firefox
sandbox evince ~/Downloads/untrusted.pdf

The jail is destroyed when the process exits. Nothing persists to the host filesystem. See the Sandbox page for details.

Boot Environments as Rollback

ZFS boot environments let you roll back a compromised or broken system state without reinstalling:

# Create a snapshot before installing untrusted software
boot-env create

# Roll back to last known-good state
boot-env rollback

Press ⌘ + Ctrl + S to snapshot the current boot environment.

Password Management

Bitwarden is included for password management. It runs as a web app via Brave with Wayland clipboard support, plus a CLI for scripting:

# CLI unlock and query
bw unlock
bw get password mysite.com

See the Bitwarden page for setup.

Screen Locking

hyprlock handles screen locking. hypridle triggers it automatically after inactivity.

# Lock immediately
hyprlock

Or press ⌘ + Ctrl + L .

Idle timeouts are configured in ~/.config/hypr/hypridle.conf. Default: lock after 5 minutes, suspend after 10.

SSH Key Management

Generate an Ed25519 key:

ssh-keygen -t ed25519 -C "$(whoami)@$(hostname)"

Use ssh-agent to avoid repeated passphrase prompts:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Store passphrases in Bitwarden rather than leaving keys unprotected.