SUSE Linux Enterprise Server 15 SP5
This guide introduces basic concepts of system security and describes the usage of security software included with the product, such as AppArmor, SELinux, or the auditing system. The guide also supports system administrators in hardening an installation.
Publication Date: September 29, 2024
- Preface
- 1 Security and confidentiality
- I Authentication
- 2 Authentication with PAM
- 3 Using NIS
- 4 Setting up authentication clients using YaST
- 5 LDAP with 389 Directory Server
- 5.1 Structure of an LDAP directory tree
- 5.2 Creating and managing a Docker container for 389 Directory Server
- 5.3 Installing 389 Directory Server
- 5.4 Firewall configuration
- 5.5 Backing up and restoring 389 Directory Server
- 5.6 Managing LDAP users and groups
- 5.7 Managing plug-ins
- 5.8 Using SSSD to manage LDAP authentication
- 5.9 Migrating to 389 Directory Server from OpenLDAP
- 5.10 Importing TLS server certificates and keys
- 5.11 Setting up replication
- 5.12 Synchronizing with Microsoft Active Directory
- 5.13 More information
- 6 Network authentication with Kerberos
- 7 Active Directory support
- 8 Setting up a freeRADIUS server
- II Local security
- 9 Physical security
- 10 Software management
- 11 File management
- 12 Encrypting partitions and files
- 13 Storage encryption for hosted applications with cryptctl
- 13.1 Setting up a
cryptctlserver - 13.2 Setting up a
cryptctlclient - 13.3 Configuring /etc/fstab for LUKS volumes
- 13.4 Checking partition unlock status using server-side commands
- 13.5 Unlocking encrypted partitions manually
- 13.6 Maintenance downtime procedure
- 13.7 Setting up an HA environment for cryptctl-server service
- 13.8 More information
- 13.1 Setting up a
- 14 User management
- 14.1 Various account checks
- 14.2 Enabling password aging
- 14.3 Stronger password enforcement
- 14.4 Password and login management with PAM
- 14.5 Restricting
rootlogins - 14.6 Restricting
sudousers - 14.7 Setting an inactivity timeout for interactive shell sessions
- 14.8 Preventing accidental denial of service
- 14.9 Displaying login banners
- 14.10 Connection accounting utilities
- 15 Restricting
cronandat - 16 Spectre/Meltdown checker
- 17 Configuring security settings with YaST
- 18 The Polkit authentication framework
- 19 Access control lists in Linux
- 20 Intrusion detection with AIDE
- III Network security
- 21 X Window System and X authentication
- 22 Securing network operations with OpenSSH
- 22.1 OpenSSH overview
- 22.2 Server hardening
- 22.3 Password authentication
- 22.4 Managing user and host encryption keys
- 22.5 Rotating host keys
- 22.6 Public key authentication
- 22.7 Passphrase-less public key authentication
- 22.8 OpenSSH certificate authentication
- 22.9 Automated public key logins with gnome-keyring
- 22.10 Automated public key logins with ssh-agent
- 22.11 Changing an SSH private key passphrase
- 22.12 Retrieving a key fingerprint
- 22.13 Starting X11 applications on a remote host
- 22.14 Agent forwarding
- 22.15
scp—secure copy - 22.16
sftp—secure file transfer - 22.17 Port forwarding (SSH tunneling)
- 22.18 More information
- 22.19 Stopping SSH Brute Force Attacks with Fail2Ban
- 23 Masquerading and firewalls
- 24 Configuring a VPN server
- 25 Managing a PKI with XCA, X certificate and key manager
- 26 Improving network security with
sysctlvariables
- IV Regulations and Compliance
- V Confining privileges with AppArmor
- 31 Introducing AppArmor
- 32 Getting started
- 33 Immunizing programs
- 34 Profile components and syntax
- 34.1 Breaking an AppArmor profile into its parts
- 34.2 Profile types
- 34.3 Include statements
- 34.4 Capability entries (POSIX.1e)
- 34.5 Network access control
- 34.6 Profile names, flags, paths, and globbing
- 34.7 File permission access modes
- 34.8 Mount rules
- 34.9 Pivot root rules
- 34.10 PTrace rules
- 34.11 Signal rules
- 34.12 Execute modes
- 34.13 Resource limit control
- 34.14 Auditing rules
- 35 AppArmor profile repositories
- 36 Building and managing profiles with YaST
- 37 Building profiles from the command line
- 38 Profiling your Web applications using ChangeHat
- 39 Confining users with
pam_apparmor - 40 Managing profiled applications
- 41 Support
- 42 AppArmor glossary
- VI SELinux
- VII The Linux Audit Framework
- 44 Understanding Linux audit
- 44.1 Introducing the components of Linux audit
- 44.2 Configuring the audit daemon
- 44.3 Controlling the audit system using
auditctl - 44.4 Passing parameters to the audit system
- 44.5 Understanding the audit logs and generating reports
- 44.6 Querying the audit daemon logs with
ausearch - 44.7 Analyzing processes with
autrace - 44.8 Visualizing audit data
- 44.9 Relaying audit event notifications
- 45 Setting up the Linux audit framework
- 46 Introducing an audit rule set
- 46.1 Adding basic audit configuration parameters
- 46.2 Adding watches on audit log files and configuration files
- 46.3 Monitoring file system objects
- 46.4 Monitoring security configuration files and databases
- 46.5 Monitoring miscellaneous system calls
- 46.6 Filtering system call arguments
- 46.7 Managing audit event records using keys
- 47 Useful resources
- 44 Understanding Linux audit
- A GNU licenses
List of Figures
- 3.1 NIS server setup
- 3.2 Master server setup
- 3.3 Changing the directory and synchronizing files for a NIS server
- 3.4 NIS server maps setup
- 3.5 Setting request permissions for a NIS server
- 3.6 Setting domain and address of a NIS server
- 5.1 Structure of an LDAP directory
- 6.1 Kerberos network topology
- 7.1 Schema of Winbind-based Active Directory authentication
- 7.2 Main window of
- 7.3 Enrolling into a domain
- 7.4 Configuration window of
- 7.5 Determining Windows domain membership
- 7.6 Providing administrator credentials
- 13.1 Key retrieval with
cryptctl(model without connection to KMIP server) - 16.1 Output from spectre-meltdown-checker
- 17.1 YaST security center and hardening: security overview
- 19.1 Minimum ACL: ACL entries compared to permission bits
- 19.2 Extended ACL: ACL entries compared to permission bits
- 22.1 jail.local file settings
- 23.1 iptables: a packet's possible paths
- 24.1 Routed VPN
- 24.2 Bridged VPN - scenario 1
- 24.3 Bridged VPN - scenario 2
- 24.4 Bridged VPN - scenario 3
- 25.1 Create a new XCA database
- 37.1
aa-notify Message in GNOME - 38.1 Adminer login page
- 44.1 Introducing the components of Linux audit
- 44.2 Flow graph—program versus system call relationship
- 44.3 Bar chart—common event types
List of Tables
- 5.1 Commonly used object classes and attributes
- 13.1 List of all parameters to define the resource group with the cryptctl crm script.
- 14.1 Sample rules/constraints for password enforcement
- 19.1 ACL entry types
- 19.2 Masking access permissions
- 20.1 Important AIDE check boxes
- 23.1 Important sysconfig variables for static port configuration
- 41.1 Man pages: sections and categories
- 44.1 Audit status flags
List of Examples
- 2.1 PAM configuration for sshd (
/etc/pam.d/sshd) - 2.2 Default configuration for the
authsection (common-auth) - 2.3 Default configuration for the
accountsection (common-account) - 2.4 Default configuration for the
passwordsection (common-password) - 2.5 Default configuration for the
sessionsection (common-session) - 2.6 pam_env.conf
- 5.1 Excerpt from CN=schema
- 5.2 Minimal 389 Directory Server instance configuration file
- 5.3 A
.dsrcfile for local administration - 5.4 Two supplier replicas
- 5.5 Four supplier replicas
- 5.6 Six replicas
- 5.7 Six replicas with read-only consumers
- 6.1 Example KDC configuration,
/etc/krb5.conf - 9.1 Configuration
- 22.1 Example sshd_config
- 23.1 Callback port configuration for the
nfskernel module in/etc/modprobe.d/60-nfs.conf - 23.2 Commands to define a new
firewalldRPC service for NFS - 24.1 VPN server configuration file
- 24.2 VPN client configuration file
- 32.1 Output of
aa-unconfined - 37.1 Learning mode exception: controlling access to specific resources
- 37.2 Learning mode exception: defining permissions for an entry
- 43.1 Security context settings using
ls -Z - 43.2 Verifying that SELinux is functional
- 43.3 Getting a list of booleans and verifying policy access
- 43.4 Getting file context information
- 43.5 The default context for directories in the root directory
- 43.6 Showing SELinux settings for processes with
ps Zaux - 43.7 Viewing default file contexts
- 43.8 Example lines from
/var/log/audit/audit.log - 43.9 Analyzing audit messages
- 43.10 Viewing which lines deny access
- 43.11 Creating a policy module allowing an action previously denied
- 44.1 Default /etc/audit/auditd.conf
- 44.2 Example output of
auditctl-s - 44.3 Example audit rules—audit system parameters
- 44.4 Example audit rules—file system auditing
- 44.5 Example audit rules—system call auditing
- 44.6 Deleting audit rules and events
- 44.7 Listing rules with
auditctl-l - 44.8 A simple audit event—viewing the audit log
- 44.9 An advanced audit event—login via SSH
- 44.10 Example /etc/audit/auditd.conf
- 44.11 Example /etc/audit/plugins.d/syslog.conf
Copyright © 2006–2024 SUSE LLC y colaboradores. Reservados todos los derechos.
Está permitido copiar, distribuir y modificar este documento según los términos de la licencia de documentación gratuita GNU, versión 1.2 o (según su criterio) versión 1.3. Este aviso de copyright y licencia deberán permanecer inalterados. En la sección titulada “GNU Free Documentation License” (Licencia de documentación gratuita GNU) se incluye una copia de la versión 1.2 de la licencia.
Para obtener información sobre las marcas comerciales de SUSE, consulte http://www.suse.com/company/legal/. Todas las marcas comerciales de otros fabricantes son propiedad de sus propietarios respectivos. Los símbolos de marcas comerciales (®, ™, etc.) indican marcas comerciales de SUSE y sus afiliados. Los asteriscos (*) indican marcas comerciales de otros fabricantes.
Toda la información recogida en esta publicación se ha compilado prestando toda la atención posible al más mínimo detalle. Sin embargo, esto no garantiza una precisión total. Ni SUSE LLC, ni sus filiales, ni los autores o traductores serán responsables de los posibles errores o las consecuencias que de ellos pudieran derivarse.