Questions[netbsd](server)

I would like to run a service inside a chroot in a NetBSD 9.1 amd64 system. The service runs if invoked from OS. The service in question is dendrite-monolith-server. I just copied the file for ease of use to start sitting inside the chroot in /bin/.

# ldd bin/start 
bin/start:
        -lpthread.1 => /usr/lib/libpthread.so.1
        -lc.12 => /usr/lib/libc.so.12

They are hard linked:

# ls -l usr/lib
total 8560
-r--r--r--  2 root  pe  2079984 Feb 22 23:40 lc.12
-r--r--r--  2 root  pe  2079984 Feb 22 23:40 libc.so.12
-r--r--r--  2 root  pe    93656 Feb 22 23:40 libpthread.so.1
-r--r--r--  2 root  pe    93656 Feb 22 23:40 lpthread.1

In the chroot /dev, did MAKEDEV all to create the devices.

Copied ld.elf_so to the chroot /libexec directory

# ls -l /libexec/
total 324
-r-xr-xr-x  1 0  1000  164344 Feb 22 23:47 ld.elf_so

ksh93 is statically linked:

# chroot ./ /bin/ksh93
#
# /bin/start 
/bin/ksh93: /bin/start: not found

What's wrong or missing?

I want to deploy a VM to serve DNS and files (via NFS) to other *nix systems in my infrastructure.

Due to reasons beyond my control, I need a very light OS, so I naturally choose the *BSD family.

Can you recommend which *BSD is the best VMware guest?

I got couple servers not long time ago with pre-installed hardware RAID5. I plan to use those servers as a dedicated NAS (with some VMs) on my LAN.

Currently I see these options:

• disconnect HDDs from RAID controller and let ZFS do the job

or

• leave controller alone and just use UFS.

What should I do in this situation and what are the best options? Plus I never used ZFS and really keen to try it out ^^.

As a base system I'm using XEN with NetBSD as DOM0.

I need apply the same rules (lists of IPs with allow and drop rules) in firewalls of Linux and *BSD. Do you know some application (CLI) for to convert a list of rules in the specific format of each firewall?.

The application for to convert the rules is only a idea. Other solutions for the problem are welcome.

I know most of the general advice: "turn off unnecessary services", "no really, turn off unnecessary services", "least privilege", etc. I've also seen a few guides and/or tools, e.g., Bastille, for hardening Linux boxes, but nothing that seems tailored to NetBSD.

Assume for the sake of this list that I've already made sure root doesn't have SSH access, but that I haven't installed any server software.

What are your first steps for securing a new NetBSD box?

UPDATE: To be clear, I'm looking for specific steps. I'm entirely self-taught when it comes to server admin, but I feel I have a decent grasp of the general principles. I'm looking for details for two reasons:

1. To see if there is anything NetBSD-specific that I've overlooked.
2. To see if other people have better methods for putting the general principles into practice.

Thanks.