Security and Hardening Guide
Introduces basic concepts of system security, covering both local and network security aspects. Shows how to use the product inherent security software like AppArmor, SELinux, or the auditing system that reliably collects information about any security-relevant events. Supports the administrator with security-related choices and decisions in installing and setting up a secure SUSE Linux Enterprise Server and additional processes to further secure and harden that installation.
- About This Guide
- 1 Security and Confidentiality
- 2 Common Criteria
- I Authentication
- II Local Security
- 10 Physical Security
- 11 Automatic Security Checks with seccheck
- 12 Software Management
- 13 File Management
- 14 Encrypting Partitions and Files
- 15 User Management
- 15.1 Various Account Checks
- 15.2 Enabling Password Aging
- 15.3 Stronger Password Enforcement
- 15.4 Password and Login Management with PAM
- 15.5 Restricting
rootLogins - 15.6 Setting an Inactivity Timeout for Interactive Shell Sessions
- 15.7 Preventing Accidental Denial of Service
- 15.8 Displaying Login Banners
- 15.9 Connection Accounting Utilities
- 16 Configuring Security Settings with YaST
- 17 The Polkit authentication framework
- 18 Access Control Lists in Linux
- 19 Certificate Store
- 20 Intrusion Detection with AIDE
- III Network Security
- 21 X Window System and X Authentication
- 22 Securing network operations with OpenSSH
- 22.1 OpenSSH overview
- 22.2 Server hardening
- 22.3 Password authentication
- 22.4 Managing user and host encryption keys
- 22.5 Rotating host keys
- 22.6 Public key authentication
- 22.7 Passphrase-less public key authentication
- 22.8 OpenSSH certificate authentication
- 22.9 Automated public key logins with gnome-keyring
- 22.10 Automated public key logins in the console with ssh-agent
- 22.11 Changing an SSH private key passphrase
- 22.12 Retrieving a key fingerprint
- 22.13 Starting X11 applications on a remote host
- 22.14 Agent forwarding
- 22.15
scp—secure copy - 22.16
sftp—secure file transfer - 22.17 Port forwarding (SSH tunneling)
- 22.18 More information
- 23 Masquerading and Firewalls
- 24 Configuring a VPN Server
- 25 Enabling compliance with FIPS 140-2
- IV Confining Privileges with AppArmor
- 26 Introducing AppArmor
- 27 Getting Started
- 28 Immunizing Programs
- 29 Profile Components and Syntax
- 29.1 Breaking an AppArmor Profile into Its Parts
- 29.2 Profile Types
- 29.3 Include Statements
- 29.4 Capability Entries (POSIX.1e)
- 29.5 Network Access Control
- 29.6 Profile Names, Flags, Paths, and Globbing
- 29.7 File Permission Access Modes
- 29.8 Mount Rules
- 29.9 Pivot Root Rules
- 29.10 PTrace Rules
- 29.11 Signal Rules
- 29.12 Execute Modes
- 29.13 Resource Limit Control
- 29.14 Auditing Rules
- 30 AppArmor Profile Repositories
- 31 Building and Managing Profiles with YaST
- 32 Building Profiles from the Command Line
- 33 Profiling Your Web Applications Using ChangeHat
- 34 Confining Users with
pam_apparmor - 35 Managing Profiled Applications
- 36 Support
- 37 AppArmor Glossary
- V SELinux
- VI The Linux Audit Framework
- 39 Understanding Linux Audit
- 39.1 Introducing the Components of Linux Audit
- 39.2 Configuring the Audit Daemon
- 39.3 Controlling the Audit System Using
auditctl - 39.4 Passing Parameters to the Audit System
- 39.5 Understanding the Audit Logs and Generating Reports
- 39.6 Querying the Audit Daemon Logs with
ausearch - 39.7 Analyzing Processes with
autrace - 39.8 Visualizing Audit Data
- 39.9 Relaying Audit Event Notifications
- 40 Setting Up the Linux Audit Framework
- 41 Introducing an Audit Rule Set
- 41.1 Adding Basic Audit Configuration Parameters
- 41.2 Adding Watches on Audit Log Files and Configuration Files
- 41.3 Monitoring File System Objects
- 41.4 Monitoring Security Configuration Files and Databases
- 41.5 Monitoring Miscellaneous System Calls
- 41.6 Filtering System Call Arguments
- 41.7 Managing Audit Event Records Using Keys
- 42 Useful Resources
- 39 Understanding Linux Audit
- A Payment Card Industry Data Security Standard (PCI DSS)
- B Licenze GNU
- 4.1 NIS Server Setup
- 4.2 Master Server Setup
- 4.3 Changing the Directory and Synchronizing Files for a NIS Server
- 4.4 NIS Server Maps Setup
- 4.5 Setting Request Permissions for a NIS Server
- 4.6 Setting Domain and Address of a NIS Server
- 7.1 Kerberos Network Topology
- 7.2 Window
- 8.1 Schema of Winbind-based Active Directory Authentication
- 8.2 Main Window of
- 8.3 Enrolling into a Domain
- 8.4 Configuration Window of
- 8.5 Determining Windows Domain Membership
- 8.6 Providing Administrator Credentials
- 16.1 YaST Security Center and Hardening: Security Overview
- 18.1 Minimum ACL: ACL Entries Compared to Permission Bits
- 18.2 Extended ACL: ACL Entries Compared to Permission Bits
- 23.1 iptables: A Packet's Possible Paths
- 24.1 Routed VPN
- 24.2 Bridged VPN - Scenario 1
- 24.3 Bridged VPN - Scenario 2
- 24.4 Bridged VPN - Scenario 3
- 32.1
aa-notify Message in GNOME - 33.1 Adminer Login Page
- 39.1 Introducing the Components of Linux Audit
- 39.2 Flow Graph—Program versus System Call Relationship
- 39.3 Bar Chart—Common Event Types
- 3.1 PAM Configuration for sshd (
/etc/pam.d/sshd) - 3.2 Default Configuration for the
authSection (common-auth) - 3.3 Default Configuration for the
accountSection (common-account) - 3.4 Default Configuration for the
passwordSection (common-password) - 3.5 Default Configuration for the
sessionSection (common-session) - 3.6 pam_env.conf
- 7.1 Example KDC Configuration,
/etc/krb5.conf - 22.1 Example sshd.conf
- 23.1 Callback Port Configuration for the
nfsKernel Module in/etc/modprobe.d/60-nfs.conf - 23.2 Commands to Define a new
firewalldRPC Service for NFS - 24.1 VPN Server Configuration File
- 24.2 VPN Client Configuration File
- 27.1 Output of
aa-unconfined - 32.1 Learning Mode Exception: Controlling Access to Specific Resources
- 32.2 Learning Mode Exception: Defining Permissions for an Entry
- 38.1 Security context settings using
ls -Z - 38.2 Verifying that SELinux is functional
- 38.3 Getting a list of booleans and verifying policy access
- 38.4 Getting file context information
- 38.5 The default context for directories in the root directory
- 38.6 Showing SELinux settings for processes with
ps Zaux - 38.7 Viewing default file contexts
- 38.8 Example lines from
/etc/audit/audit.log - 38.9 Analyzing audit messages
- 38.10 Viewing which lines deny access
- 38.11 Creating a policy module allowing an action previously denied
- 39.1 Example output of
auditctl-s - 39.2 Example Audit Rules—Audit System Parameters
- 39.3 Example Audit Rules—File System Auditing
- 39.4 Example Audit Rules—System Call Auditing
- 39.5 Deleting Audit Rules and Events
- 39.6 Listing Rules with
auditctl-l - 39.7 A simple audit event—viewing the audit log
- 39.8 An Advanced Audit Event—Login via SSH
- 39.9 Example /etc/audisp/audispd.conf
- 39.10 Example /etc/audisp/plugins.d/syslog.conf
Copyright © 2006– 2022 SUSE LLC e collaboratori. Tutti i diritti riservati.
L'autorizzazione per la copia, la distribuzione e/o la modifica di questo documento è soggetta ai termini indicati nella licenza GFDL (GNU Free Documentation License), versione 1.2 oppure, a scelta, 1.3, di cui la presente licenza e le presenti informazioni sul copyright rappresentano la sezione non variabile. Una copia della licenza versione 1.2 è inclusa nella sezione intitolata “GNU Free Documentation License”.
Per i marchi di fabbrica SUSE vedere http://www.suse.com/company/legal/. Tutti gli altri marchi di fabbrica di terze parti sono proprietà dei rispettivi titolari. I simboli di marchio di fabbrica (®, ™ e così via) indicano i marchi di fabbrica appartenenti a SUSE e alle rispettive affiliate. Gli asterischi (*) indicano i marchi di fabbrica di terze parti.
Tutte le informazioni nella presente pubblicazione sono state compilate con la massima attenzione ai dettagli. Ciò, tuttavia, non garantisce una precisione assoluta. SUSE LLC, le rispettive affiliate, gli autori e i traduttori non potranno essere ritenuti responsabili di eventuali errori o delle relative conseguenze.