openSUSE Leap Documentation › Security and Hardening Guide

Security and Hardening Guide

Navigation←→

openSUSE Leap 15.2

Security and Hardening Guide

Introduces basic concepts of system security, covering both local and network security aspects. Shows how to use the product inherent security software like AppArmor, SELinux, or the auditing system that reliably collects information about any security-relevant events. Supports the administrator with security-related choices and decisions in installing and setting up a secure SUSE Linux Enterprise Server and additional processes to further secure and harden that installation.

Publication Date: December 16, 2020

About This Guide

Available Documentation
Giving Feedback
Documentation Conventions

1 Security and Confidentiality

1.1 Overview
1.2 Passwords
1.3 System Integrity
1.4 File Access
1.5 Networking
1.6 Software Vulnerabilities
1.7 Malware
1.8 Important Security Tips
1.9 Reporting Security Issues

2 Common Criteria

2.1 Introduction
2.2 Evaluation Assurance Level (EAL)
2.3 Generic Guiding Principles
2.4 For More Information

I Authentication

3 Authentication with PAM

3.1 What is PAM?
3.2 Structure of a PAM Configuration File
3.3 The PAM Configuration of sshd
3.4 Configuration of PAM Modules
3.5 Configuring PAM Using pam-config
3.6 Manually Configuring PAM
3.7 For More Information

4 Using NIS

4.1 Configuring NIS Servers
4.2 Configuring NIS Clients

5 Setting Up Authentication Clients Using YaST

5.1 Configuring an Authentication Client with YaST
5.2 SSSD

6 LDAP—A Directory Service

6.1 Structure of an LDAP Directory Tree
6.2 Installing the Software for 389 Directory Server
6.3 Manually Configuring a 389 Directory Server
6.4 Setting Up a 389 Directory Server with YaST
6.5 Manually Administering LDAP Data
6.6 For More Information

7 Network Authentication with Kerberos

7.1 Conceptual Overview
7.2 Kerberos Terminology
7.3 How Kerberos Works
7.4 User View of Kerberos
7.5 Installing and Administering Kerberos
7.6 Setting up Kerberos using LDAP and Kerberos Client
7.7 Kerberos and NFS
7.8 For More Information

8 Active Directory Support

8.1 Integrating Linux and Active Directory Environments
8.2 Background Information for Linux Active Directory Support
8.3 Configuring a Linux Client for Active Directory
8.4 Logging In to an Active Directory Domain
8.5 Changing Passwords

9 Setting Up a FreeRADIUS Server

9.1 Installation and Testing on SUSE Linux Enterprise

II Local Security

10 Physical Security

10.1 System Locks
10.2 Locking Down the BIOS
10.3 Security via the Boot Loaders
10.4 Retiring Linux Servers with Sensitive Data
10.5 Restricting Access to Removable Media

11 Automatic Security Checks with seccheck

11.1 Seccheck Timers
11.2 Enabling Seccheck Timers
11.3 Daily, Weekly, and Monthly Checks
11.4 Automatic Logout

12 Software Management

12.1 Removing Unnecessary Software Packages (RPMs)
12.2 Patching Linux Systems

13 File Management

13.1 Disk Partitions
13.2 Checking File Permissions and Ownership
13.3 Default umask
13.4 SUID/SGID Files
13.5 World-Writable Files
13.6 Orphaned or Unowned Files

14 Encrypting Partitions and Files

14.1 Setting Up an Encrypted File System with YaST
14.2 Encrypting Files with GPG

15 Storage Encryption for Hosted Applications with cryptctl

15.1 Setting Up a cryptctl Server
15.2 Setting Up a cryptctl Client
15.3 Checking Partition Unlock Status Using Server-side Commands
15.4 Unlocking Encrypted Partitions Manually
15.5 Maintenance Downtime Procedure
15.6 For More Information

16 User Management

16.1 Various Account Checks
16.2 Enabling Password Aging
16.3 Stronger Password Enforcement
16.4 Password and Login Management with PAM
16.5 Restricting root Logins
16.6 Setting an Inactivity Timeout for Interactive Shell Sessions
16.7 Preventing Accidental Denial of Service
16.8 Displaying Login Banners
16.9 Connection Accounting Utilities

17 Spectre/Meltdown Checker

17.1 Using spectre-meltdown-checker
17.2 Additional Information about Spectre/Meltdown

18 Configuring Security Settings with YaST

18.1 Security Overview
18.2 Predefined Security Configurations
18.3 Password Settings
18.4 Boot Settings
18.5 Login Settings
18.6 User Addition
18.7 Miscellaneous Settings

19 Authorization with PolKit

19.1 Conceptual Overview
19.2 Authorization Types
19.3 Querying Privileges
19.4 Modifying Configuration Files
19.5 Restoring the Default Privileges

20 Access Control Lists in Linux

20.1 Traditional File Permissions
20.2 Advantages of ACLs
20.3 Definitions
20.4 Handling ACLs
20.5 ACL Support in Applications
20.6 For More Information

21 Certificate Store

21.1 Activating Certificate Store
21.2 Importing Certificates

22 Intrusion Detection with AIDE

22.1 Why Use AIDE?
22.2 Setting Up an AIDE Database
22.3 Local AIDE Checks
22.4 System Independent Checking
22.5 For More Information

III Network Security

23 X Window System and X Authentication

24 SSH: Secure Network Operations

24.1 ssh—Secure Shell
24.2 scp—Secure Copy
24.3 sftp—Secure File Transfer
24.4 The SSH Daemon (sshd)
24.5 SSH Authentication Mechanisms
24.6 Port Forwarding
24.7 Adding and Removing Public Keys on an Installed System
24.8 For More Information

25 Masquerading and Firewalls

25.1 Packet Filtering with iptables
25.2 Masquerading Basics
25.3 Firewalling Basics
25.4 firewalld
25.5 Migrating from SuSEfirewall2
25.6 For More Information

26 Configuring a VPN Server

26.1 Conceptual Overview
26.2 Setting Up a Simple Test Scenario
26.3 Setting Up Your VPN Server Using a Certificate Authority
26.4 Setting Up a VPN Server or Client Using YaST
26.5 For More Information

IV Confining Privileges with AppArmor

27 Introducing AppArmor

27.1 AppArmor Components
27.2 Background Information on AppArmor Profiling

28 Getting Started

28.1 Installing AppArmor
28.2 Enabling and Disabling AppArmor
28.3 Choosing Applications to Profile
28.4 Building and Modifying Profiles
28.5 Updating Your Profiles

29 Immunizing Programs

29.1 Introducing the AppArmor Framework
29.2 Determining Programs to Immunize
29.3 Immunizing cron Jobs
29.4 Immunizing Network Applications

30 Profile Components and Syntax

30.1 Breaking an AppArmor Profile into Its Parts
30.2 Profile Types
30.3 Include Statements
30.4 Capability Entries (POSIX.1e)
30.5 Network Access Control
30.6 Profile Names, Flags, Paths, and Globbing
30.7 File Permission Access Modes
30.8 Mount Rules
30.9 Pivot Root Rules
30.10 PTrace Rules
30.11 Signal Rules
30.12 Execute Modes
30.13 Resource Limit Control
30.14 Auditing Rules

31 AppArmor Profile Repositories

32 Building and Managing Profiles with YaST

32.1 Manually Adding a Profile
32.2 Editing Profiles
32.3 Deleting a Profile
32.4 Managing AppArmor

33 Building Profiles from the Command Line

33.1 Checking the AppArmor Status
33.2 Building AppArmor Profiles
33.3 Adding or Creating an AppArmor Profile
33.4 Editing an AppArmor Profile
33.5 Unloading Unknown AppArmor Profiles
33.6 Deleting an AppArmor Profile
33.7 Two Methods of Profiling
33.8 Important File Names and Directories

34 Profiling Your Web Applications Using ChangeHat

34.1 Configuring Apache for mod_apparmor
34.2 Managing ChangeHat-Aware Applications

35 Confining Users with pam_apparmor

36 Managing Profiled Applications

36.1 Reacting to Security Event Rejections
36.2 Maintaining Your Security Profiles

37 Support

37.1 Updating AppArmor Online
37.2 Using the Man Pages
37.3 For More Information
37.4 Troubleshooting
37.5 Reporting Bugs for AppArmor

38 AppArmor Glossary

V SELinux

39 Configuring SELinux

39.1 Why Use SELinux?
39.2 Policy
39.3 Installing SELinux Packages and Modifying GRUB 2
39.4 SELinux Policy
39.5 Configuring SELinux
39.6 Managing SELinux
39.7 Troubleshooting

VI The Linux Audit Framework

40 Understanding Linux Audit

40.1 Introducing the Components of Linux Audit
40.2 Configuring the Audit Daemon
40.3 Controlling the Audit System Using auditctl
40.4 Passing Parameters to the Audit System
40.5 Understanding the Audit Logs and Generating Reports
40.6 Querying the Audit Daemon Logs with ausearch
40.7 Analyzing Processes with autrace
40.8 Visualizing Audit Data
40.9 Relaying Audit Event Notifications

41 Setting Up the Linux Audit Framework

41.1 Determining the Components to Audit
41.2 Configuring the Audit Daemon
41.3 Enabling Audit for System Calls
41.4 Setting Up Audit Rules
41.5 Configuring Audit Reports
41.6 Configuring Log Visualization

42 Introducing an Audit Rule Set

42.1 Adding Basic Audit Configuration Parameters
42.2 Adding Watches on Audit Log Files and Configuration Files
42.3 Monitoring File System Objects
42.4 Monitoring Security Configuration Files and Databases
42.5 Monitoring Miscellaneous System Calls
42.6 Filtering System Call Arguments
42.7 Managing Audit Event Records Using Keys

43 Useful Resources

A GNU Licenses

A.1 GNU Free Documentation License

List of Figures

4.1 NIS Server Setup
4.2 Master Server Setup
4.3 Changing the Directory and Synchronizing Files for a NIS Server
4.4 NIS Server Maps Setup
4.5 Setting Request Permissions for a NIS Server
4.6 Setting Domain and Address of a NIS Server
6.1 Structure of an LDAP Directory
6.2 LDAP and Kerberos Client Window
7.1 Kerberos Network Topology
7.2 LDAP and Kerberos Client Window
8.1 Schema of Winbind-based Active Directory Authentication
8.2 Main Window of User Logon Management
8.3 Enrolling into a Domain
8.4 Configuration Window of User Logon Management
8.5 Determining Windows Domain Membership
8.6 Providing Administrator Credentials
15.1 Key Retrieval with cryptctl (Model Without Connection to KMIP Server)
17.1 Output from spectre-meltdown-checker
18.1 YaST Security Center and Hardening: Security Overview
20.1 Minimum ACL: ACL Entries Compared to Permission Bits
20.2 Extended ACL: ACL Entries Compared to Permission Bits
25.1 iptables: A Packet's Possible Paths
26.1 Routed VPN
26.2 Bridged VPN - Scenario 1
26.3 Bridged VPN - Scenario 2
26.4 Bridged VPN - Scenario 3
33.1 aa-notify Message in GNOME
34.1 Adminer Login Page
39.1 Selecting all SELinux Packages in YaST
40.1 Introducing the Components of Linux Audit
40.2 Flow Graph—Program versus System Call Relationship
40.3 Bar Chart—Common Event Types

List of Tables

6.1 Commonly Used Object Classes and Attributes
16.1 Sample rules/constraints for password enforcement
20.1 ACL Entry Types
20.2 Masking Access Permissions
22.1 Important AIDE Check Boxes
24.1
25.1 Important Sysconfig Variables for Static Port Configuration
37.1 Man Pages: Sections and Categories
40.1 Audit Status Flags

List of Examples

3.1 PAM Configuration for sshd (/etc/pam.d/sshd)
3.2 Default Configuration for the auth Section (common-auth)
3.3 Default Configuration for the account Section (common-account)
3.4 Default Configuration for the password Section (common-password)
3.5 Default Configuration for the session Section (common-session)
3.6 pam_env.conf
6.1 Excerpt from CN=schema
6.2 Basic Instance Configuration File
6.3 A .dsrc File for Remote Administration
6.4 A .dsrc File for Local Administration
7.1 Example KDC Configuration, /etc/krb5.conf
25.1 Callback Port Configuration for the nfs Kernel Module in /etc/modprobe.d/60-nfs.conf
25.2 Commands to Define a new firewalld RPC Service for NFS
26.1 VPN Server Configuration File
26.2 VPN Client Configuration File
28.1 Output of aa-unconfined
33.1 Learning Mode Exception: Controlling Access to Specific Resources
33.2 Learning Mode Exception: Defining Permissions for an Entry
39.1 Security Context Settings Using ls -Z
39.2 Verifying that SELinux is functional
39.3 Getting a List of Booleans and Verifying Policy Access
39.4 Getting File Context Information
39.5 The default context for directories in the root directory
39.6 Showing SELinux settings for processes with ps Zaux
39.7 Viewing Default File Contexts
39.8 Example Lines from /etc/audit/audit.log
39.9 Analyzing Audit Messages
39.10 Viewing Which Lines Deny Access
39.11 Creating a Policy Module Allowing an Action Previously Denied
40.1 Example output of auditctl -s
40.2 Example Audit Rules—Audit System Parameters
40.3 Example Audit Rules—File System Auditing
40.4 Example Audit Rules—System Call Auditing
40.5 Deleting Audit Rules and Events
40.6 Listing Rules with auditctl -l
40.7 A Simple Audit Event—Viewing the Audit Log
40.8 An Advanced Audit Event—Login via SSH
40.9 Example /etc/audisp/audispd.conf
40.10 Example /etc/audisp/plugins.d/syslog.conf

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”.

For SUSE trademarks, see https://www.suse.com/company/legal/. All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks (*) denote third-party trademarks.

All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its affiliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof.

Print this page