Contents
Security and Hardening Guide
- Preface
- 1 Security and confidentiality
- 2 Common Criteria
- I Authentication
- II Local security
- 10 Physical security
- 11 Software management
- 12 File management
- 13 Encrypting partitions and files
- 14 Storage encryption for hosted applications with cryptctl
- 15 User management
- 16 Restricting
cronandat - 17 Spectre/Meltdown checker
- 18 Configuring security settings with YaST
- 19 Authorization with PolKit
- 20 Access control lists in Linux
- 21 Intrusion detection with AIDE
- III Network security
- IV Confining privileges with AppArmor
- 29 Introducing AppArmor
- 30 Getting started
- 31 Immunizing programs
- 32 Profile components and syntax
- 33 AppArmor profile repositories
- 34 Building and managing profiles with YaST
- 35 Building profiles from the command line
- 36 Profiling your Web applications using ChangeHat
- 37 Confining users with
pam_apparmor - 38 Managing profiled applications
- 39 Support
- 40 AppArmor glossary
- V SELinux
- VI The Linux Audit Framework
- A Achieving PCI DSS compliance
- B GNU licenses
SUSE Linux Enterprise Server 15 SP3
Security and Hardening Guide
Abstract#
This guide introduces basic concepts of system security and describes the usage of security software included with the product, such as AppArmor, SELinux, or the auditing system. The guide also supports system administrators in hardening an installation.
Publication Date:
May 03, 2022
- Preface
- 1 Security and confidentiality
- 2 Common Criteria
- I Authentication
- 3 Authentication with PAM
- 4 Using NIS
- 5 Setting up authentication clients using YaST
- 6 LDAP with 389 Directory Server
- 6.1 Structure of an LDAP directory tree
- 6.2 Installing 389 Directory Server
- 6.3 Firewall configuration
- 6.4 Backing up and restoring 389 Directory Server
- 6.5 Managing LDAP users and groups
- 6.6 Using SSSD to manage LDAP authentication
- 6.7 Managing modules
- 6.8 Migrating to 389 Directory Server from OpenLDAP
- 6.9 Importing TLS server certificates and keys
- 6.10 Setting up replication
- 6.11 Synchronizing with Microsoft Active Directory
- 6.12 More information
- 7 Network authentication with Kerberos
- 8 Active Directory support
- 9 Setting up a freeRADIUS server
- II Local security
- 10 Physical security
- 11 Software management
- 12 File management
- 13 Encrypting partitions and files
- 14 Storage encryption for hosted applications with cryptctl
- 15 User management
- 15.1 Various account checks
- 15.2 Enabling password aging
- 15.3 Stronger password enforcement
- 15.4 Password and login management with PAM
- 15.5 Restricting
rootlogins - 15.6 Restricting
sudousers - 15.7 Setting an inactivity timeout for interactive shell sessions
- 15.8 Preventing accidental denial of service
- 15.9 Displaying login banners
- 15.10 Connection accounting utilities
- 16 Restricting
cronandat - 17 Spectre/Meltdown checker
- 18 Configuring security settings with YaST
- 19 Authorization with PolKit
- 20 Access control lists in Linux
- 21 Intrusion detection with AIDE
- III Network security
- 22 X Window System and X authentication
- 23 Securing network operations with OpenSSH
- 23.1 OpenSSH overview
- 23.2 Server hardening
- 23.3 Password authentication
- 23.4
scp—secure copy - 23.5
sftp—secure file transfer - 23.6 The SSH daemon (
sshd) - 23.7 SSH authentication mechanisms
- 23.8 Restricting SSH logins
- 23.9 Port forwarding
- 23.10 Adding and removing public keys on an installed system
- 23.11 More information
- 24 Masquerading and firewalls
- 25 Configuring a VPN server
- 26 Managing a PKI with XCA, X certificate and key manager
- 27 Improving network security with
sysctlvariables - 28 Enabling compliance with FIPS 140-2
- IV Confining privileges with AppArmor
- 29 Introducing AppArmor
- 30 Getting started
- 31 Immunizing programs
- 32 Profile components and syntax
- 32.1 Breaking an AppArmor profile into its parts
- 32.2 Profile types
- 32.3 Include statements
- 32.4 Capability entries (POSIX.1e)
- 32.5 Network access control
- 32.6 Profile names, flags, paths, and globbing
- 32.7 File permission access modes
- 32.8 Mount rules
- 32.9 Pivot root rules
- 32.10 PTrace rules
- 32.11 Signal rules
- 32.12 Execute modes
- 32.13 Resource limit control
- 32.14 Auditing rules
- 33 AppArmor profile repositories
- 34 Building and managing profiles with YaST
- 35 Building profiles from the command line
- 36 Profiling your Web applications using ChangeHat
- 37 Confining users with
pam_apparmor - 38 Managing profiled applications
- 39 Support
- 40 AppArmor glossary
- V SELinux
- VI The Linux Audit Framework
- 42 Understanding Linux audit
- 42.1 Introducing the components of Linux audit
- 42.2 Configuring the audit daemon
- 42.3 Controlling the audit system using
auditctl - 42.4 Passing parameters to the audit system
- 42.5 Understanding the audit logs and generating reports
- 42.6 Querying the audit daemon logs with
ausearch - 42.7 Analyzing processes with
autrace - 42.8 Visualizing audit data
- 42.9 Relaying audit event notifications
- 43 Setting up the Linux audit framework
- 44 Introducing an audit rule set
- 44.1 Adding basic audit configuration parameters
- 44.2 Adding watches on audit log files and configuration files
- 44.3 Monitoring file system objects
- 44.4 Monitoring security configuration files and databases
- 44.5 Monitoring miscellaneous system calls
- 44.6 Filtering system call arguments
- 44.7 Managing audit event records using keys
- 45 Useful resources
- A Achieving PCI DSS compliance
- B GNU licenses
List of Figures
- 4.1 NIS server setup
- 4.2 Master server setup
- 4.3 Changing the directory and synchronizing files for a NIS server
- 4.4 NIS server maps setup
- 4.5 Setting request permissions for a NIS server
- 4.6 Setting domain and address of a NIS server
- 6.1 Structure of an LDAP directory
- 7.1 Kerberos network topology
- 8.1 Schema of Winbind-based Active Directory authentication
- 8.2 Main window of
- 8.3 Enrolling into a domain
- 8.4 Configuration window of
- 8.5 Determining Windows domain membership
- 8.6 Providing administrator credentials
- 14.1 Key retrieval with
cryptctl(model without connection to KMIP server) - 17.1 Output from spectre-meltdown-checker
- 18.1 YaST security center and hardening: security overview
- 20.1 Minimum ACL: ACL entries compared to permission bits
- 20.2 Extended ACL: ACL entries compared to permission bits
- 24.1 iptables: a packet's possible paths
- 25.1 Routed VPN
- 25.2 Bridged VPN - scenario 1
- 25.3 Bridged VPN - scenario 2
- 25.4 Bridged VPN - scenario 3
- 26.1 Create a new XCA database
- 35.1
aa-notify Message in GNOME - 36.1 Adminer login page
- 41.1 Selecting all SELinux packages in YaST
- 42.1 Introducing the components of Linux audit
- 42.2 Flow graph—program versus system call relationship
- 42.3 Bar chart—common event types
List of Tables
- 6.1 Commonly used object classes and attributes
- 15.1 Sample rules/constraints for password enforcement
- 20.1 ACL entry types
- 20.2 Masking access permissions
- 21.1 Important AIDE check boxes
- 23.1
- 24.1 Important sysconfig variables for static port configuration
- 39.1 Man pages: sections and categories
- 42.1 Audit status flags
List of Examples
- 3.1 PAM configuration for sshd (
/etc/pam.d/sshd) - 3.2 Default configuration for the
authsection (common-auth) - 3.3 Default configuration for the
accountsection (common-account) - 3.4 Default configuration for the
passwordsection (common-password) - 3.5 Default configuration for the
sessionsection (common-session) - 3.6 pam_env.conf
- 6.1 Excerpt from CN=schema
- 6.2 Minimal 389 Directory Server instance configuration file
- 6.3 A
.dsrcfile for local administration - 6.4 Two supplier replicas
- 6.5 Four supplier replicas
- 6.6 Six replicas
- 6.7 Six replicas with read-only consumers
- 7.1 Example KDC configuration,
/etc/krb5.conf - 24.1 Callback port configuration for the
nfskernel module in/etc/modprobe.d/60-nfs.conf - 24.2 Commands to define a new
firewalldRPC service for NFS - 25.1 VPN server configuration file
- 25.2 VPN client configuration file
- 30.1 Output of
aa-unconfined - 35.1 Learning mode exception: controlling access to specific resources
- 35.2 Learning mode exception: defining permissions for an entry
- 41.1 Verifying that SELinux is functional
- 41.2 Getting a list of booleans and verifying policy access
- 41.3 Getting file context information
- 41.4 The default context for directories in the root directory
- 41.5 Showing SELinux settings for processes with
ps Zaux - 41.6 Viewing default file contexts
- 41.7 Example lines from
/etc/audit/audit.log - 41.8 Analyzing audit messages
- 41.9 Viewing which lines deny access
- 41.10 Creating a policy module allowing an action previously denied
- 42.1 Example output of
auditctl-s - 42.2 Example audit rules—audit system parameters
- 42.3 Example audit rules—file system auditing
- 42.4 Example audit rules—system call auditing
- 42.5 Deleting audit rules and events
- 42.6 Listing rules with
auditctl-l - 42.7 A simple audit event—viewing the audit log
- 42.8 An advanced audit event—login via SSH
- 42.9 Example /etc/audisp/audispd.conf
- 42.10 Example /etc/audisp/plugins.d/syslog.conf
Copyright © 2006– 2022 SUSE LLC y colaboradores. Reservados todos los derechos.
Está permitido copiar, distribuir y modificar este documento según los términos de la licencia de documentación gratuita GNU, versión 1.2 o (según su criterio) versión 1.3. Este aviso de copyright y licencia deberán permanecer inalterados. En la sección titulada “GNU Free Documentation License” (Licencia de documentación gratuita GNU) se incluye una copia de la versión 1.2 de la licencia.
Para obtener información sobre las marcas comerciales de SUSE, consulte https://www.suse.com/company/legal/. Todas las marcas comerciales de otros fabricantes son propiedad de sus respectivas empresas. Los símbolos de marca comercial (®,™ etc.) indican marcas comerciales de SUSE y sus afiliados. Los asteriscos (*) indican marcas comerciales de otros fabricantes.
Toda la información recogida en esta publicación se ha compilado prestando toda la atención posible al más mínimo detalle. Sin embargo, esto no garantiza una precisión total. Ni SUSE LLC, ni sus filiales, ni los autores o traductores serán responsables de los posibles errores o las consecuencias que de ellos pudieran derivarse.