#!/bin/sh
# FreeBSD directory and file hardening script, ideally to be used before adding any users. chmod 700 it and put it in your path. edit accordingly. 
/bin/chmod 711 /home
/bin/chmod 711 /home/*
/bin/chmod 700 /root
/bin/chmod 711 /var/mail
/bin/chmod 640 /var/run/utmp
/bin/chmod 711 /
/bin/chmod 751 /sbin
/bin/chmod 751 /usr/sbin
/bin/chmod 751 /usr/local/sbin
/bin/chmod 750 /var/log
/bin/chmod 600 /var/log/*
/bin/chmod 640 /var/log/wtmp
/bin/chmod 640 /var/run/utmp
/bin/chmod 640 /var/log/l5i.log
/bin/chmod 640 /var/log/auth.log
/bin/chmod 711 /etc/ssh
/bin/chmod 640 /etc/ssh/sshd_config
/bin/chmod 700 /usr/src
/bin/chmod 700 /sys
/bin/chmod 640 /var/run/dmesg.boot
/bin/chmod 600 /etc/crontab
/bin/chmod 400 /var/db/locate.database
/bin/chmod 600 /etc/pf.conf
/bin/chmod 640 /etc/rc.conf
/bin/chmod 640 /etc/rc.bsdextended

/bin/chmod 600 /etc/sysctl.conf
/bin/chmod 600 /etc/master.passwd
/bin/chmod 640 /etc/ftpusers
/bin/chmod 640 /etc/syslog.conf
/bin/touch /etc/COPYRIGHT
/bin/touch /usr/share/skel/dot.bash_history
/bin/chmod 600 /usr/share/skel/dot.bash_history
/bin/touch /usr/share/skel/dot.history
/bin/chmod 600 /usr/share/skel/dot.history
/bin/chflags sappnd /usr/share/skel/dot.bash_history
/bin/chflags sappnd /usr/share/skel/dot.history
/bin/chflags sappnd /home/*/.history
/bin/chflags sappnd /home/*/.bash_history
/bin/chflags sappnd /var/log 
/bin/chflags sappnd /var/log/*