Contents
Security and Hardening Guide
- Preface
- 1 Security and confidentiality
- 2 Common Criteria
- I Authentication
- II Local security
- 10 Physical security
- 11 Software management
- 12 File management
- 13 Encrypting partitions and files
- 14 Storage encryption for hosted applications with cryptctl
- 15 User management
- 16 Restricting
cronandat - 17 Spectre/Meltdown checker
- 18 Configuring security settings with YaST
- 19 Authorization with PolKit
- 20 Access control lists in Linux
- 21 Intrusion detection with AIDE
- III Network security
- IV Confining privileges with AppArmor
- 29 Introducing AppArmor
- 30 Getting started
- 31 Immunizing programs
- 32 Profile components and syntax
- 33 AppArmor profile repositories
- 34 Building and managing profiles with YaST
- 35 Building profiles from the command line
- 36 Profiling your Web applications using ChangeHat
- 37 Confining users with
pam_apparmor - 38 Managing profiled applications
- 39 Support
- 40 AppArmor glossary
- V SELinux
- VI The Linux Audit Framework
- A GNU licenses
openSUSE Leap 15.3
Security and Hardening Guide
Abstract#
This guide introduces basic concepts of system security and describes the usage of security software included with the product, such as AppArmor, SELinux, or the auditing system. The guide also supports system administrators in hardening an installation.
Publication Date:
May 25, 2022
- Preface
- 1 Security and confidentiality
- 2 Common Criteria
- I Authentication
- 3 Authentication with PAM
- 4 Using NIS
- 5 Setting up authentication clients using YaST
- 6 LDAP with 389 Directory Server
- 6.1 Structure of an LDAP directory tree
- 6.2 Installing 389 Directory Server
- 6.3 Firewall configuration
- 6.4 Backing up and restoring 389 Directory Server
- 6.5 Managing LDAP users and groups
- 6.6 Using SSSD to manage LDAP authentication
- 6.7 Managing modules
- 6.8 Migrating to 389 Directory Server from OpenLDAP
- 6.9 Importing TLS server certificates and keys
- 6.10 Setting up replication
- 6.11 Synchronizing with Microsoft Active Directory
- 6.12 More information
- 7 Network authentication with Kerberos
- 8 Active Directory support
- 9 Setting up a freeRADIUS server
- II Local security
- 10 Physical security
- 11 Software management
- 12 File management
- 13 Encrypting partitions and files
- 14 Storage encryption for hosted applications with cryptctl
- 15 User management
- 15.1 Various account checks
- 15.2 Enabling password aging
- 15.3 Stronger password enforcement
- 15.4 Password and login management with PAM
- 15.5 Restricting
rootlogins - 15.6 Restricting
sudousers - 15.7 Setting an inactivity timeout for interactive shell sessions
- 15.8 Preventing accidental denial of service
- 15.9 Displaying login banners
- 15.10 Connection accounting utilities
- 16 Restricting
cronandat - 17 Spectre/Meltdown checker
- 18 Configuring security settings with YaST
- 19 Authorization with PolKit
- 20 Access control lists in Linux
- 21 Intrusion detection with AIDE
- III Network security
- 22 X Window System and X authentication
- 23 Securing network operations with OpenSSH
- 23.1 OpenSSH overview
- 23.2 Server hardening
- 23.3 Password authentication
- 23.4
scp—secure copy - 23.5
sftp—secure file transfer - 23.6 The SSH daemon (
sshd) - 23.7 SSH authentication mechanisms
- 23.8 Restricting SSH logins
- 23.9 Port forwarding
- 23.10 Adding and removing public keys on an installed system
- 23.11 More information
- 24 Masquerading and firewalls
- 25 Configuring a VPN server
- 26 Managing a PKI with XCA, X certificate and key manager
- 27 Improving network security with
sysctlvariables - 28 Enabling compliance with FIPS 140-2
- IV Confining privileges with AppArmor
- 29 Introducing AppArmor
- 30 Getting started
- 31 Immunizing programs
- 32 Profile components and syntax
- 32.1 Breaking an AppArmor profile into its parts
- 32.2 Profile types
- 32.3 Include statements
- 32.4 Capability entries (POSIX.1e)
- 32.5 Network access control
- 32.6 Profile names, flags, paths, and globbing
- 32.7 File permission access modes
- 32.8 Mount rules
- 32.9 Pivot root rules
- 32.10 PTrace rules
- 32.11 Signal rules
- 32.12 Execute modes
- 32.13 Resource limit control
- 32.14 Auditing rules
- 33 AppArmor profile repositories
- 34 Building and managing profiles with YaST
- 35 Building profiles from the command line
- 36 Profiling your Web applications using ChangeHat
- 37 Confining users with
pam_apparmor - 38 Managing profiled applications
- 39 Support
- 40 AppArmor glossary
- V SELinux
- VI The Linux Audit Framework
- 42 Understanding Linux audit
- 42.1 Introducing the components of Linux audit
- 42.2 Configuring the audit daemon
- 42.3 Controlling the audit system using
auditctl - 42.4 Passing parameters to the audit system
- 42.5 Understanding the audit logs and generating reports
- 42.6 Querying the audit daemon logs with
ausearch - 42.7 Analyzing processes with
autrace - 42.8 Visualizing audit data
- 42.9 Relaying audit event notifications
- 43 Setting up the Linux audit framework
- 44 Introducing an audit rule set
- 44.1 Adding basic audit configuration parameters
- 44.2 Adding watches on audit log files and configuration files
- 44.3 Monitoring file system objects
- 44.4 Monitoring security configuration files and databases
- 44.5 Monitoring miscellaneous system calls
- 44.6 Filtering system call arguments
- 44.7 Managing audit event records using keys
- 45 Useful resources
- A GNU licenses
List of Figures
- 4.1 NIS server setup
- 4.2 Master server setup
- 4.3 Changing the directory and synchronizing files for a NIS server
- 4.4 NIS server maps setup
- 4.5 Setting request permissions for a NIS server
- 4.6 Setting domain and address of a NIS server
- 6.1 Structure of an LDAP directory
- 7.1 Kerberos network topology
- 8.1 Schema of Winbind-based Active Directory authentication
- 8.2 Main window of
- 8.3 Enrolling into a domain
- 8.4 Configuration window of
- 8.5 Determining Windows domain membership
- 8.6 Providing administrator credentials
- 14.1 Key retrieval with
cryptctl(model without connection to KMIP server) - 17.1 Output from spectre-meltdown-checker
- 18.1 YaST security center and hardening: security overview
- 20.1 Minimum ACL: ACL entries compared to permission bits
- 20.2 Extended ACL: ACL entries compared to permission bits
- 24.1 iptables: a packet's possible paths
- 25.1 Routed VPN
- 25.2 Bridged VPN - scenario 1
- 25.3 Bridged VPN - scenario 2
- 25.4 Bridged VPN - scenario 3
- 26.1 Create a new XCA database
- 35.1
aa-notify Message in GNOME - 36.1 Adminer login page
- 41.1 Selecting all SELinux packages in YaST
- 42.1 Introducing the components of Linux audit
- 42.2 Flow graph—program versus system call relationship
- 42.3 Bar chart—common event types
List of Tables
- 6.1 Commonly used object classes and attributes
- 15.1 Sample rules/constraints for password enforcement
- 20.1 ACL entry types
- 20.2 Masking access permissions
- 21.1 Important AIDE check boxes
- 23.1
- 24.1 Important sysconfig variables for static port configuration
- 39.1 Man pages: sections and categories
- 42.1 Audit status flags
List of Examples
- 3.1 PAM configuration for sshd (
/etc/pam.d/sshd) - 3.2 Default configuration for the
authsection (common-auth) - 3.3 Default configuration for the
accountsection (common-account) - 3.4 Default configuration for the
passwordsection (common-password) - 3.5 Default configuration for the
sessionsection (common-session) - 3.6 pam_env.conf
- 6.1 Excerpt from CN=schema
- 6.2 Minimal 389 Directory Server instance configuration file
- 6.3 A
.dsrcfile for local administration - 6.4 Two supplier replicas
- 6.5 Four supplier replicas
- 6.6 Six replicas
- 6.7 Six replicas with read-only consumers
- 7.1 Example KDC configuration,
/etc/krb5.conf - 24.1 Callback port configuration for the
nfskernel module in/etc/modprobe.d/60-nfs.conf - 24.2 Commands to define a new
firewalldRPC service for NFS - 25.1 VPN server configuration file
- 25.2 VPN client configuration file
- 30.1 Output of
aa-unconfined - 35.1 Learning mode exception: controlling access to specific resources
- 35.2 Learning mode exception: defining permissions for an entry
- 41.1 Verifying that SELinux is functional
- 41.2 Getting a list of booleans and verifying policy access
- 41.3 Getting file context information
- 41.4 The default context for directories in the root directory
- 41.5 Showing SELinux settings for processes with
ps Zaux - 41.6 Viewing default file contexts
- 41.7 Example lines from
/etc/audit/audit.log - 41.8 Analyzing audit messages
- 41.9 Viewing which lines deny access
- 41.10 Creating a policy module allowing an action previously denied
- 42.1 Example output of
auditctl-s - 42.2 Example audit rules—audit system parameters
- 42.3 Example audit rules—file system auditing
- 42.4 Example audit rules—system call auditing
- 42.5 Deleting audit rules and events
- 42.6 Listing rules with
auditctl-l - 42.7 A simple audit event—viewing the audit log
- 42.8 An advanced audit event—login via SSH
- 42.9 Example /etc/audisp/audispd.conf
- 42.10 Example /etc/audisp/plugins.d/syslog.conf
Copyright © 2006– 2022 SUSE LLC and contributors. All rights reserved.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”.
For SUSE trademarks, see https://www.suse.com/company/legal/. All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks (*) denote third-party trademarks.
All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its affiliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof.