Security Guide
Introduces basic concepts of system security, covering both local and network security aspects. Shows how to use the product inherent security software like AppArmor or the auditing system that reliably collects information about any security-relevant events.
- About This Guide
- 1 Security and Confidentiality
- I Authentication
- II Local Security
- III Network Security
- IV Confining Privileges with AppArmor
- 19 Introducing AppArmor
- 20 Getting Started
- 21 Immunizing Programs
- 22 Profile Components and Syntax
- 23 AppArmor Profile Repositories
- 24 Building and Managing Profiles with YaST
- 25 Building Profiles from the Command Line
- 26 Profiling Your Web Applications Using ChangeHat
- 27 Confining Users with
pam_apparmor - 28 Managing Profiled Applications
- 29 Support
- 30 AppArmor Glossary
- V SELinux
- VI The Linux Audit Framework
- 32 Understanding Linux Audit
- 32.1 Introducing the Components of Linux Audit
- 32.2 Configuring the Audit Daemon
- 32.3 Controlling the Audit System Using
auditctl - 32.4 Passing Parameters to the Audit System
- 32.5 Understanding the Audit Logs and Generating Reports
- 32.6 Querying the Audit Daemon Logs with
ausearch - 32.7 Analyzing Processes with
autrace - 32.8 Visualizing Audit Data
- 32.9 Relaying Audit Event Notifications
- 33 Setting Up the Linux Audit Framework
- 34 Introducing an Audit Rule Set
- 34.1 Adding Basic Audit Configuration Parameters
- 34.2 Adding Watches on Audit Log Files and Configuration Files
- 34.3 Monitoring File System Objects
- 34.4 Monitoring Security Configuration Files and Databases
- 34.5 Monitoring Miscellaneous System Calls
- 34.6 Filtering System Call Arguments
- 34.7 Managing Audit Event Records Using Keys
- 35 Useful Resources
- 32 Understanding Linux Audit
- A Achieving PCI DSS Compliance
- B Documentation Updates
- B.1 October 2018 (Maintenance Release for SUSE Linux Enterprise Server 12 SP3)
- B.2 September 2017 (Initial Release of SUSE Linux Enterprise Server 12 SP3)
- B.3 November 2016 (Initial Release of SUSE Linux Enterprise Server 12 SP2)
- B.4 March 2016 (Documentation Maintenance Update for SUSE Linux Enterprise Server 12 SP1)
- B.5 December 2015 (Initial Release of SUSE Linux Enterprise Server 12 SP1)
- B.6 February 2015 (Documentation Maintenance Update)
- B.7 October 2014 (Initial Release of SUSE Linux Enterprise Server 12)
- C GNU-Lizenzen
- 3.1 NIS Server Setup
- 3.2 Master Server Setup
- 3.3 Changing the Directory and Synchronizing Files for a NIS Server
- 3.4 NIS Server Maps Setup
- 3.5 Setting Request Permissions for a NIS Server
- 3.6 Setting Domain and Address of a NIS Server
- 4.1 YaST Authentication Server Configuration
- 4.2 YaST LDAP Server—New Database
- 4.3 YaST Kerberos Authentication
- 4.4 YaST Editing Authentication Server Configuration
- 4.5 YaST Authentication Server Database Configuration
- 5.1 Structure of an LDAP Directory
- 5.2 Window
- 6.1 Kerberos Network Topology
- 6.2 Window
- 7.1 Schema of Winbind-based Active Directory Authentication
- 7.2 Main Window of
- 7.3 Enrolling into a Domain
- 7.4 Configuration Window of
- 7.5 Determining Windows Domain Membership
- 7.6 Providing Administrator Credentials
- 8.1 YaST Security Center and Hardening: Security Overview
- 10.1 Minimum ACL: ACL Entries Compared to Permission Bits
- 10.2 Extended ACL: ACL Entries Compared to Permission Bits
- 15.1 iptables: A Packet's Possible Paths
- 15.2 Firewall Configuration: Allowed Services
- 16.1 Routed VPN
- 16.2 Bridged VPN - Scenario 1
- 16.3 Bridged VPN - Scenario 2
- 16.4 Bridged VPN - Scenario 3
- 17.1 YaST CA Module—Basic Data for a Root CA
- 17.2 YaST CA Module—Using a CA
- 17.3 Certificates of a CA
- 17.4 YaST CA Module—Extended Settings
- 25.1
aa-notify Message in GNOME - 26.1 Adminer Login Page
- 31.1 Selecting all SELinux Packages in YaST
- 32.1 Introducing the Components of Linux Audit
- 32.2 Flow Graph—Program versus System Call Relationship
- 32.3 Bar Chart—Common Event Types
- 2.1 PAM Configuration for sshd (
/etc/pam.d/sshd) - 2.2 Default Configuration for the
authSection (common-auth) - 2.3 Default Configuration for the
accountSection (common-account) - 2.4 Default Configuration for the
passwordSection (common-password) - 2.5 Default Configuration for the
sessionSection (common-session) - 2.6 pam_env.conf
- 5.1 Excerpt from schema.core
- 5.2 An LDIF File
- 5.3 ldapadd with example.ldif
- 5.4 LDIF Data for Tux
- 5.5 Modified LDIF File tux.ldif
- 16.1 VPN Server Configuration File
- 16.2 VPN Client Configuration File
- 20.1 Output of
aa-unconfined - 25.1 Learning Mode Exception: Controlling Access to Specific Resources
- 25.2 Learning Mode Exception: Defining Permissions for an Entry
- 31.1 Security Context Settings Using
ls -Z - 31.2 Verifying that SELinux is functional
- 31.3 Getting a List of Booleans and Verifying Policy Access
- 31.4 Getting File Context Information
- 31.5 The default context for directories in the root directory
- 31.6 Showing SELinux settings for processes with
ps Zaux - 31.7 Viewing Default File Contexts
- 31.8 Example Lines from
/etc/audit/audit.log - 31.9 Analyzing Audit Messages
- 31.10 Viewing Which Lines Deny Access
- 31.11 Creating a Policy Module Allowing an Action Previously Denied
- 32.1 Example output of
auditctl-s - 32.2 Example Audit Rules—Audit System Parameters
- 32.3 Example Audit Rules—File System Auditing
- 32.4 Example Audit Rules—System Call Auditing
- 32.5 Deleting Audit Rules and Events
- 32.6 Listing Rules with
auditctl-l - 32.7 A Simple Audit Event—Viewing the Audit Log
- 32.8 An Advanced Audit Event—Login via SSH
- 32.9 Example /etc/audisp/audispd.conf
- 32.10 Example /etc/audisp/plugins.d/syslog.conf
Copyright © 2006– 2022 SUSE LLC und Mitwirkende. Alle Rechte vorbehalten.
Es wird die Genehmigung erteilt, dieses Dokument unter den Bedingungen der GNU Free Documentation License, Version 1.2 oder (optional) Version 1.3 zu vervielfältigen, zu verbreiten und/oder zu verändern; die unveränderlichen Abschnitte hierbei sind der Urheberrechtshinweis und die Lizenzbedingungen. Eine Kopie dieser Lizenz (Version 1.2) finden Sie im Abschnitt “GNU Free Documentation License”.
Die SUSE-Marken finden Sie unter http://www.suse.com/company/legal/. Alle anderen Marken von Drittanbietern sind Besitz ihrer jeweiligen Eigentümer. Markensymbole (®, ™ usw.) kennzeichnen Marken von SUSE und der Tochtergesellschaften. Sternchen (*) kennzeichnen Marken von Drittanbietern.
Alle Informationen in diesem Buch wurden mit größter Sorgfalt zusammengestellt. Doch auch dadurch kann hundertprozentige Richtigkeit nicht gewährleistet werden. Weder SUSE LLC noch ihre Tochtergesellschaften noch die Autoren noch die Übersetzer können für mögliche Fehler und deren Folgen haftbar gemacht werden.