Security and Hardening Guide
- About This Guide
- 1 Security and Confidentiality
- 2 Common Criteria
- I Authentication
- II Local Security
- 10 Physical Security
- 11 Automatic Security Checks with seccheck
- 12 Software Management
- 13 File Management
- 14 Encrypting Partitions and Files
- 15 Storage Encryption for Hosted Applications with cryptctl
- 16 User Management
- 17 Spectre/Meltdown Checker
- 18 Configuring Security Settings with YaST
- 19 Authorization with PolKit
- 20 Access Control Lists in Linux
- 21 Certificate Store
- 22 Intrusion Detection with AIDE
- III Network Security
- IV Confining Privileges with AppArmor
- 27 Introducing AppArmor
- 28 Getting Started
- 29 Immunizing Programs
- 30 Profile Components and Syntax
- 31 AppArmor Profile Repositories
- 32 Building and Managing Profiles with YaST
- 33 Building Profiles from the Command Line
- 34 Profiling Your Web Applications Using ChangeHat
- 35 Confining Users with
pam_apparmor - 36 Managing Profiled Applications
- 37 Support
- 38 AppArmor Glossary
- V SELinux
- VI The Linux Audit Framework
- A GNU Licenses
Part I Authentication #Edit source
- 3 Authentication with PAM
Linux uses PAM (pluggable authentication modules) in the authentication process as a layer that mediates between user and application. PAM modules are available on a system-wide basis, so they can be requested by any application. This chapter describes how the modular authentication mechanism works and how it is configured.
- 4 Using NIS
When multiple Unix systems in a network access common resources, it becomes imperative that all user and group identities are the same for all machines in that network. The network should be transparent to users: their environments should not vary, regardless of which machine they are actually using. This can be done by means of NIS and NFS services. NFS distributes file systems over a network and is discussed in Book “Reference”, Chapter 22 “Sharing File Systems with NFS”.
NIS (Network Information Service) can be described as a database-like service that provides access to the contents of
/etc/passwd,/etc/shadow, and/etc/groupacross networks. NIS can also be used for other purposes (making the contents of files like/etc/hostsor/etc/servicesavailable, for example), but this is beyond the scope of this introduction. People often refer to NIS as YP, because it works like the network's “yellow pages.”- 5 Setting Up Authentication Clients Using YaST
Whereas Kerberos is used for authentication, LDAP is used for authorization and identification. Both can work together. For more information about LDAP, see Chapter 6, LDAP—A Directory Service, and about Kerberos, see Chapter 7, Network Authentication with Kerberos.
- 6 LDAP—A Directory Service
The Lightweight Directory Access Protocol (LDAP) is a protocol designed to access and maintain information directories. LDAP can be used for user and group management, system configuration management, address management, and more. This chapter provides a basic understanding of how LDAP works.
- 7 Network Authentication with Kerberos
Kerberos is a network authentication protocol which also provides encryption. This chapter describes how to set up Kerberos and integrate services like LDAP and NFS.
- 8 Active Directory Support
Active Directory* (AD) is a directory-service based on LDAP, Kerberos, and other services. It is used by Microsoft* Windows* to manage resources, services, and people. In a Microsoft Windows network, Active Directory provides information about these objects, restricts access to them, and enforces po…
- 9 Setting Up a FreeRADIUS Server
The RADIUS (Remote Authentication Dial-In User Service) protocol has long been a standard service for manage network access. It performs authentication, authorization, and accounting (AAA) protocol for very large businesses such as Internet service providers and cellular network providers, and is al…