Security & Hardening

RealNAS reduces default exposure by keeping middleware local, serving the WebUI over HTTPS, removing vendor phone-home paths, and separating package install from mutable first-boot bootstrap. It does not remove the need for ordinary system administration: network boundaries, SSH policy, backups, monitoring, updates, and physical security remain operator responsibilities.

---

Default Management Surface

The intended public management surface is realnas_webui. Middleware is a local backend unless an operator explicitly changes rc.conf settings.

Surface	Default	Security Meaning
WebUI	0.0.0.0:4200, TLS enabled	Browser-facing admin UI and API/WebSocket proxy.
WebUI backend	http://127.0.0.1:6000	Proxy-to-middleware path stays loopback.
Middleware TCP	127.0.0.1:6000	Local API backend for WebUI and local automation.
Middleware Unix sockets	/var/run/middlewared.sock, /var/run/middlewared-internal.sock	Root-owned sockets with mode 0600; runtime directory mode 0700.

# disable middleware TCP entirely and keep only Unix sockets
sysrc realnasd_tcp_listen=NO
service realnasd restart

# changing middleware to a wildcard bind is explicit operator exposure
sysrc realnasd_bind_host=0.0.0.0

---

First Login

RealNAS release packages do not install a production default password. Package install preserves the FreeBSD account state it finds; realnas-bootstrap imports system users and groups into middleware state through user.sync_builtin.

Production first-login rules:

• If the system has no usable root password, the unauthenticated first-login root-password path may set it once.
• If no local administrator exists, the setup path may create an initial wheel/sudo administrator.
• Both first-login paths require a password of at least 12 characters.
• RealNAS does not enable root SSH or password SSH for production installs. SSH follows the operator's FreeBSD sshd_config and sysrc choices.
• Smoke credentials such as root / realnas belong only to disposable test VMs and are not release defaults.

WebUI TLS

The WebUI is HTTPS by default. Bootstrap creates the default certificate/key pair only when both files are absent:

realnas_webui_tls="YES"
realnas_webui_cert="/var/db/realnas/webui.crt"
realnas_webui_key="/var/db/realnas/webui.key"

The first-boot certificate is self-signed, valid for 825 days, and includes localhost, the current hostname, realnas.local, 127.0.0.1, and ::1. The certificate is mode 0644; the key is mode 0600. If only one default file exists, bootstrap fails instead of guessing. Remove both files to regenerate, or install a complete replacement pair.

install -o root -g wheel -m 0644 fullchain.pem /var/db/realnas/webui.crt
install -o root -g wheel -m 0600 privkey.pem /var/db/realnas/webui.key
service realnas_webui restart

Test tooling may use curl -k or browser self-signed-certificate exceptions. That is not a recommendation for normal administration after you have a trusted certificate path available.

Certificate Validation

Certificate and CSR handling enforces the following rules:

• Subject Alternative Name parsing handles email and URI SANs per RFC 5280 §4.2.1.6. URI is checked first so https://user@host is not misclassified as an email address.
• CA descendant counting walks the signedby graph with a depth-capped BFS (depth 8) so a misconfigured chain cannot stall the certificate workflow.
• Importing a CSR with an attached private key requires the supplied key to match the CSR's public key, verified by DER-encoded SubjectPublicKeyInfo comparison. Mismatched material is rejected with a validation error before any state is persisted.

---

Secret Permissions

Persistent secrets live either in the encrypted middleware database or in root-owned files required by service daemons. File-backed secrets must be created with restrictive mode from the first write, not written world-readable and fixed afterward.

Path	Required Mode
/var/db/realnas/pwenc_secret	root:wheel, regular file, 0600.
/var/db/system/samba4/private	root:wheel, directory, 0700.
/etc/krb5.keytab	root:wheel, 0600 when present.
/var/db/system/samba4/private/samba.keytab	root:wheel, 0600 when present.
/usr/local/etc/users.oath	root:wheel, 0600 when present.
/etc/ssh/ssh_host_*_key	root:wheel, 0600 when present.
/etc/certificates/*.key and /etc/certificates/CA/*.key	root:wheel, 0400 or 0600 when present.

stat -f '%Sp %u:%g %N' /var/db/realnas/pwenc_secret
stat -f '%Sp %u:%g %N' /var/db/realnas/webui.key
find /etc/certificates -name '*.key' -exec stat -f '%Sp %u:%g %N' {} + 2>/dev/null

---

Removed Network Calls

RealNAS inherits code from appliance projects that contacted vendor or third-party services. These paths are removed, disabled, or replaced in the RealNAS build.

Crash and error reporting

The CrashReporting class in middleware logging is permanently neutered: enabled_in_settings is hard-set to False and the module contains no requests, urllib, or sentry_sdk imports. Tracebacks remain in local logs.

Anonymous usage statistics

Periodic reports of pool layout, feature use, and hardware information to vendor endpoints are removed.

Diagnostic upload flow

Inherited flows for sending diagnostic information to support endpoints are removed from the default install. Local diagnostic capture lives in system.debug_generate, which writes a local .tgz with no network egress and never calls the support.* namespace.

Commercial support registration

Appliance registration forms and endpoints are not part of RealNAS.

Vendor update train

Updates use update.update — a single atomic transaction over freebsd-update, pkg, and bectl — not an appliance image train.

TrueCommand/cloud monitor

Proprietary monitoring and cloud-support surfaces are disabled or absent by default.

A fresh install should initiate outbound traffic only for services the administrator configures: package mirrors, SMTP, syslog forwarding, replication targets, directory services, or optional integrations.

The architecture contract scans active source for nine telemetry vendor name fragments (sentry-sdk, sentry_sdk, raven-python, datadog-checks, newrelic, appdynamics, rollbar-python, bugsnag, honeybadger) and blocks any reintroduction. The same gate forbids requests.post/requests.put/urllib.request.urlopen/urllib3.connectionpool/sentry_sdk. calls in the crash-reporting path.

---

Privileged Commands

High-risk OS mutation is routed through named adapters and a privileged-command registry. The registry is not a generic subprocess escape hatch; it documents owners for mutations that need validation and rollback/convergence tests.

Owner	Examples
Disk and ZFS	gpart, geli, gmultipath, zfs, zpool.
Services and rc.conf	service, sysrc.
Updates and boot environments	freebsd-update, pkg, bectl.
User database	pw, chpass, vipw, pwd_mkdb.
Kernel and sysctl	kldload, kldunload, sysctl.

New mutation surfaces should get an owner adapter and tests instead of adding one-off root subprocess calls.

---

Directory Services

SMB must remain usable on a local-only system. AD, LDAP, and NIS are not silently enabled on a default install. Directory-service pages may render and read APIs may respond, but domain-backed identity must remain disabled or degraded until a real directory service is configured and joined.

• Invalid AD and LDAP enable attempts should fail validation before they persist configuration or attempt a remote join/bind.
• Disabled AD/LDAP/NIS must not leak winbind, LDAP URI, or base DN entries into generated NSS or LDAP client config.
• Directory alert sources remain disabled until their owning services have real health checks and regression coverage.
• Disposable LDAP/Kerberos/AD fixture testing is still open release-hardening work.

---

Operator Hardening

Restrict Management Access

Keep the WebUI and SSH off guest and general client networks. Bind management services to a management interface when possible, or enforce access with firewall rules. Do not expose middleware TCP directly unless you have a specific automation need and compensating controls.

Harden SSH

Add administrative keys first, then disable password SSH and restrict root login according to your policy.

# example policy in /etc/ssh/sshd_config or an sshd_config.d snippet
PasswordAuthentication no
PermitRootLogin prohibit-password

Encrypt Sensitive Datasets

Use native ZFS encryption for datasets that hold sensitive records. Store passphrases and keys outside the array. For imported legacy GELI pools, keep original key material until the RealNAS import and read-back are verified.

Use Boot Environments

Take a boot environment before upgrades or risky host changes.

bectl create pre-change-$(date +%Y%m%d)
bectl list

Keep Backups Off the Host

Snapshots are not backups. Replicate important snapshots to another system, preferably another physical location, and test restore procedures.

Watch Logs and Alerts

Configure SMTP or another alert path, but keep local log review in your runbook. Send logs to another host if they need to survive boot-device failure.

midclt call alert.list
tail -100 /var/log/realnas/middlewared.log
tail -100 /var/log/messages