root@freebsd-sftp:~ # mkdir -p /usr/local/etc/pkg/repos
root@freebsd-sftp:~ # vi /usr/local/etc/pkg/repos/FreeBSD.conf

```
FreeBSD: {
  url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest"
}
```

# To protect the server incase of front-end breach
# Author: vgnshlvnz and couple of website examples
# DO NOT MODIFY THE FILE WITHOUT PERMISSION

#Interface
extif='em0'

#ICMP Types
icmp_types = '{ echoreq unreach}'

#RFC6890 address block table

table <rfc6890> { 0/8 10/8 100.64/10 127/8 169.254/16          \
                  172.16/12 192/24 192/29 192.0.2/24 192.88.99/24 \
                  192.168/16 198.18/15 198.51.100/24 203.0.113/24 \
                  240/4 255.255.255.255/32 }

#Scrubbing traffic
scrub log on $extif all random-id min-ttl 15 set-tos 0x1c fragment reassemble max-mss 1440

#Skip Loopback
set skip on lo0
set debug urgent
set block-policy drop
set loginterface $extif
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
set optimization aggressive

#RFC6890 ruleset
block log (all, to pflog0) in quick on egress from <rfc6890>
block log (all, to pflog0) return out quick on egress to <rfc6890>

#Anti-spoofing
antispoof quick for $extif

#Block all connections
block log (all, to pflog0)

#Allow SSH in
pass in log (all, to pflog0) on $extif  proto tcp to port 22

#Pass out SSH DNS NTP and WEB SERVICES
pass out proto {tcp, udp} to port {22,53,80,123,443}

#Allow ICMP echorequest
pass out inet proto icmp icmp-type $icmp_types

Match Group sftp
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

clamav_clamd_enable=YES
clamav_freshclam_enable=YES

- ipvar HOME_NET [YOU_NEED_TO_SET_HOME_NET_IN_snort.conf]
- ipvar EXTERNAL_NET any
+ ipvar HOME_NET [192.168.0.0/16,10.0.0.0/8]
+ ipvar EXTERNAL_NET !$HOME_NET
- var WHITE_LIST_PATH ../rules
- var BLACK_LIST_PATH ../rules
+ var WHITE_LIST_PATH rules
+ var BLACK_LIST_PATH rules
- # output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
+ output unified2: filename merged.log, limit 128, mpls_event_types, vlan_event_types
+ include $RULE_PATH/local.rules
+ include $RULE_PATH/snort.rules

rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|XXXX
rule_url=https://s3.amazonaws.com/snort-org/www/rules/community/|community-rules.tar.gz|Community
rule_url=http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|open
rule_url=https://www.snort.org/reg-rules/|opensource.gz|XXXX
ignore=deleted.rules,experimental.rules,local.rules
temp_path=/tmp
rule_path=/usr/local/etc/snort/rules/snort.rules
local_rules=/usr/local/etc/snort/rules/local.rules
sid_msg=/usr/local/etc/snort/sid-msg.map
sid_msg_version=1
sid_changelog=/var/log/snort/sid_changes.log
sorule_path=/usr/local/etc/snort/so_rules/
snort_path=/usr/local/bin/snort
config_path=/usr/local/etc/snort/snort.conf
distro=FreeBSD-9-0
black_list=/usr/local/etc/snort/rules/iplists/default.blacklist
IPRVersion=/usr/local/etc/snort/rules/iplists
snort_control=/usr/local/bin/snort_control
version=0.7.0