Jump to contentJump to page navigation: previous page [access key p]/next page [access key n]
ContentsContents
Security and Hardening Guide
  1. About This Guide
  2. 1 Security and Confidentiality
  3. 2 Common Criteria
  4. I Authentication
    1. 3 Authentication with PAM
    2. 4 Using NIS
    3. 5 Setting Up Authentication Clients Using YaST
    4. 6 LDAP with 389 Directory Server
    5. 7 Network Authentication with Kerberos
    6. 8 Active Directory Support
    7. 9 Setting Up a FreeRADIUS Server
  5. II Local Security
    1. 10 Physical Security
    2. 11 Software Management
    3. 12 File Management
    4. 13 Encrypting Partitions and Files
    5. 14 Storage Encryption for Hosted Applications with cryptctl
    6. 15 User Management
    7. 16 Restricting cron and at
    8. 17 Spectre/Meltdown Checker
    9. 18 Configuring Security Settings with YaST
    10. 19 Authorization with PolKit
    11. 20 Access Control Lists in Linux
    12. 21 Certificate Store
    13. 22 Intrusion Detection with AIDE
  6. III Network Security
    1. 23 X Window System and X Authentication
    2. 24 SSH: Secure Network Operations
    3. 25 Masquerading and Firewalls
    4. 26 Configuring a VPN Server
    5. 27 Improving Network Security with sysctl Variables
    6. 28 Enabling FIPS 140-2
  7. IV Confining Privileges with AppArmor
    1. 29 Introducing AppArmor
    2. 30 Getting Started
    3. 31 Immunizing Programs
    4. 32 Profile Components and Syntax
    5. 33 AppArmor Profile Repositories
    6. 34 Building and Managing Profiles with YaST
    7. 35 Building Profiles from the Command Line
    8. 36 Profiling Your Web Applications Using ChangeHat
    9. 37 Confining Users with pam_apparmor
    10. 38 Managing Profiled Applications
    11. 39 Support
    12. 40 AppArmor Glossary
  8. V SELinux
    1. 41 Configuring SELinux
  9. VI The Linux Audit Framework
    1. 42 Understanding Linux Audit
    2. 43 Setting Up the Linux Audit Framework
    3. 44 Introducing an Audit Rule Set
    4. 45 Useful Resources
  10. A Achieving PCI DSS Compliance
  11. B GNU-Lizenzen
Navigation
Applies to SUSE Linux Enterprise Server 15 SP2

Part III Network Security

23 X Window System and X Authentication

As mentioned at the beginning, network transparency is one of the central characteristics of a Unix system. X, the windowing system of Unix operating systems, can use this feature in an impressive way. With X, it is no problem to log in to a remote host and start a graphical program that is then sen…

24 SSH: Secure Network Operations

In networked environments, it is often necessary to access hosts from a remote location. If a user sends login and password strings for authentication purposes as plain text, they could be intercepted and misused to gain access to that user account. This would open all the user's files to an attacker and the illegal account could be used to obtain administrator or root access, or to penetrate other systems. In the past, remote connections were established with telnet, rsh or rlogin, which offered no guards against eavesdropping in the form of encryption or other security mechanisms. There are other unprotected communication channels, like the traditional FTP protocol and some remote copying programs like rcp.

25 Masquerading and Firewalls

Whenever Linux is used in a network environment, you can use the kernel functions that allow the manipulation of network packets to maintain a separation between internal and external network areas. The Linux netfilter framework provides the means to establish an effective firewall that keeps differ…

26 Configuring a VPN Server

Today, Internet connections are cheap and available almost everywhere. However, not all connections are secure. Using a Virtual Private Network (VPN), you can create a secure network within an insecure network such as the Internet or Wi-Fi. It can be implemented in different ways and serves several purposes. In this chapter, we focus on the OpenVPN implementation to link branch offices via secure wide area networks (WANs).

27 Improving Network Security with sysctl Variables

Sysctl (system control) variables control certain kernel parameters that influence the behavior of different parts of the operating system, for example the Linux network stack. These parameters can be looked up in the proc file system, in /proc/sys. Many kernel parameters can be changed directly by …

28 Enabling FIPS 140-2

The Federal Information Processing Standard 140-2 (FIPS 140-2) is a security standard for cryptographic modules. Modules are certified by the National Institute of Standards and Technology (NIST, see https://csrc.nist.gov/projects/cryptographic-module-validation-program). See https://www.suse.com/support/security/certifications/ for a list of certified modules.

Print this page