2 FreeBSD Features

Netgraph is a modular networking subsystem that can be used to supplement the existing kernel networking infrastructure. Hooks are provided to allow developers to derive their own modules. As a result, rapid prototyping and production deployment of enhanced network services can be performed far more easily and with fewer bugs. Many existing operational modules ship with FreeBSD and include support for:

• PPPoE

• ATM

• ISDN

• Bluetooth

• HDLC

• EtherChannel

• Frame Relay

• L2TP, just to name a few.

GEOM is a modular disk I/O request transformation framework. Since it is a pluggable storage layer, it permits new storage services to be quickly developed and cleanly integrated into the FreeBSD storage subsystem. Some examples where this can be useful are:

• Creating RAID solutions.

• Providing full-blown cryptographic protection of stored data.

Newer versions of FreeBSD provide many administrative utilities to use the existing GEOM modules. For example, one can create a disk mirror using gmirror(8), a stripe using gstripe(8), and a shared secret device using gshsec(8).

GBDE, or GEOM Based Disk Encryption, provides strong cryptographic protection and can protect file systems, swap devices, and other uses of storage media. In addition, GBDE transparently encrypts entire file systems, not just individual files. No cleartext ever touches the hard drive's platter.

MAC, or Mandatory Access Control, provides fine-tuned access to files and is meant to augment traditional operating system authorization provided by file permissions. Since MAC is implemented as a modular framework, a FreeBSD system can be configured for any required policy varying from HIPAA compliance to the needs of a military-grade system.

FreeBSD ships with modules to implement the following policies; however the framework allows you to develop any required policy:

• Biba integrity model

• Port ACLs

• MLS or Multi-Level Security confidentiality policy

• LOMAC or Low-watermark Mandatory Access Control data integrity policy

• Process partition policy

Like Linux, FreeBSD provides support for PAM, Pluggable Authentication Modules. This allows an administrator to augment the traditional UNIX® username/password authentication model. FreeBSD provides modules to integrate into many authentication mechanisms, including:

• Kerberos 5

• OPIE

• RADIUS

• TACACS+

It also allows the administrator to define policies to control authentication issues such as the quality of user-chosen passwords.