Security and Hardening Guide
- Preface
- 1 Security and confidentiality
- I Authentication
- II Local security
- 9 Physical security
- 10 Software management
- 11 File management
- 12 Encrypting partitions and files
- 13 Storage encryption for hosted applications with cryptctl
- 14 User management
- 15 Restricting
cronandat - 16 Spectre/Meltdown checker
- 17 Configuring security settings with YaST
- 18 The Polkit authentication framework
- 19 Access control lists in Linux
- 20 Intrusion detection with AIDE
- III Network security
- IV Confining privileges with AppArmor
- 27 Introducing AppArmor
- 28 Getting started
- 29 Immunizing programs
- 30 Profile components and syntax
- 31 AppArmor profile repositories
- 32 Building and managing profiles with YaST
- 33 Building profiles from the command line
- 34 Profiling your Web applications using ChangeHat
- 35 Confining users with
pam_apparmor - 36 Managing profiled applications
- 37 Support
- 38 AppArmor glossary
- V SELinux
- VI The Linux Audit Framework
- A GNU licenses
Part VI The Linux Audit Framework #Edit source
- 40 Understanding Linux audit
The Linux audit framework as shipped with this version of openSUSE Leap provides a CAPP-compliant (Controlled Access Protection Profiles) auditing system that reliably collects information about any security-relevant event. The audit records can be examined to determine whether any violation of the security policies has been committed, and by whom.
Providing an audit framework is an important requirement for a CC-CAPP/EAL (Common Criteria-Controlled Access Protection Profiles/Evaluation Assurance Level) certification. Common Criteria (CC) for Information Technology Security Information is an international standard for independent security evaluations. Common Criteria helps customers judge the security level of any IT product they intend to deploy in mission-critical setups.
Common Criteria security evaluations have two sets of evaluation requirements, functional and assurance requirements. Functional requirements describe the security attributes of the product under evaluation and are summarized under the Controlled Access Protection Profiles (CAPP). Assurance requirements are summarized under the Evaluation Assurance Level (EAL). EAL describes any activities that must take place for the evaluators to be confident that security attributes are present, effective and implemented. Examples for activities of this kind include documenting the developers' search for security vulnerabilities, the patch process, and testing.
This guide provides a basic understanding of how audit works and how it can be set up. For more information about Common Criteria itself, refer to the Common Criteria Web site.
- 41 Setting up the Linux audit framework
This chapter shows how to set up a simple audit scenario. Every step involved in configuring and enabling audit is explained in detail. After you have learned to set up audit, consider a real-world example scenario in Chapter 42, Introducing an audit rule set.
- 42 Introducing an audit rule set
The following example configuration illustrates how audit can be used to monitor your system. It highlights the most important items that need to be audited to cover the list of auditable events specified by Controlled Access Protection Profile (CAPP).
- 43 Useful resources
There are other resources available containing valuable information about the Linux audit framework: