安全和强化指南

出版日期：2024 年 12 月 12 日 · USBGuard

# command
> sudo command
> command
> echo a b \
c d
> command
output
TYPE  CONTROL
 MODULE_PATH  MODULE_ARGS
#%PAM-1.0 1

auth     requisite      pam_nologin.so                              2
auth     include        common-auth                                 3
account  requisite      pam_nologin.so                              2
account  include        common-account                              3
password include        common-password                             3
session  required       pam_loginuid.so                             4
session  include        common-session                              3
session  optional       pam_lastlog.so   silent noupdate showfailed 5
auth  required  pam_env.so                   1
auth  optional  pam_gnome_keyring.so         2
auth  required  pam_unix.so  try_first_pass 3
account  required  pam_unix.so  try_first_pass
password  requisite  pam_cracklib.so
password  optional   pam_gnome_keyring.so  use_authtok
password  required   pam_unix.so  use_authtok nullok shadow try_first_pass
session  required  pam_limits.so
session  required  pam_unix.so  try_first_pass
session  optional  pam_umask.so
session  optional  pam_systemd.so
session  optional  pam_gnome_keyring.so auto_start only_if=gdm,gdm-password,lxdm,lightdm
session  optional  pam_env.so
VARIABLE  [DEFAULT=VALUE]  [OVERRIDE=VALUE]
REMOTEHOST  DEFAULT=localhost          OVERRIDE=@{PAM_RHOST}
DISPLAY     DEFAULT=${REMOTEHOST}:0.0  OVERRIDE=${DISPLAY}
> sudo mkdir -p ~/.config/Yubico
> sudo pamu2fcfg > ~/.config/Yubico/u2f_keys
> sudo pamu2fcfg -n >> ~/.config/Yubico/u2f_keys
> sudo mkdir /etc/Yubico
> sudo mv ~/.config/Yubico/u2f_keys /etc/Yubico/u2f_keys
#%PAM-1.0
auth      include    common-auth
auth      required   pam_u2f.so
account   include    common-account
password  include    common-password
session   optional   pam_keyinit.so revoke
session   include    common-session
#session  optional   pam_xauth.so
#%PAM-1.0
auth     requisite pam_nologin.so
auth     include   common-auth
auth  required pam_u2f.so authfile=<PATH_TO_u2f_keys>
...
# systemctl status sssd
sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled)
   Active: active (running) since Thu 2015-10-23 11:03:43 CEST; 5s ago
   [...]
> sudo systemctl stop sssd
> sudo rm -f /var/lib/sss/db/*
> sudo systemctl start sssd
attributetype (1.2.840.113556.1.2.102 NAME 'memberOf' 1
       DESC 'Group that the entry belongs to' 2
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 3
       X-ORIGIN 'Netscape Delegated Administrator') 4

objectclass (2.16.840.1.113730.3.2.333 NAME 'nsPerson' 5
       DESC 'A representation of a person in a directory server' 6
       SUP top STRUCTURAL 7
       MUST ( displayName $ cn ) 8
       MAY ( userPassword $ seeAlso $ description $ legalName $ mail \
             $ preferredLanguage ) 9
       X-ORIGIN '389 Directory Server Project'
  ...
>  docker pull 389ds/dirsrv:latest
>  docker volume create VOLUME
>  docker create \
 -u USERNAME \
 -e SUFFIX_NAME="dc=example,dc=com" \
 -e DS_DM_PASSWORD=PASSWORD \
 -m 1024M \
 -p 3389:3389 -p 3636:3636 \
 -v VOLUME:/data \
 --name INSTANCE \
 389ds/dirsrv:latest

>  docker start INSTANCE
> sudo docker exec -u USERNAME -i -t INSTANCE COMMAND
> sudo docker exec -u USERNAME -i -t INSTANCE sh -c "COMMAND"
>  docker stop INSTANCE
>  docker rm INSTANCE
> sudo zypper install 389-ds
# LDAP1.inf

[general]
config_version = 2 1

[slapd]
root_password = PASSWORD2
self_sign_cert = True 3
instance_name = LDAP1

[backend-userroot]
sample_entries = yes 4
suffix = dc=LDAP1,dc=COM
> sudo dscreate -v from-file LDAP1.inf | \
tee LDAP1-OUTPUT.txt
> sudo dsctl LDAP1 status
Instance "LDAP1" is running
> sudo dsctl LDAP1 remove
Not removing: if you are sure, add --do-it

> sudo dsctlLDAP1 remove --do-it
> sudo dsctl -l
slapd-LDAP1
> sudo dscreate create-template
> sudo dscreate create-template TEMPLATE.txt
# full_machine_name (str)
# Description: Sets the fully qualified hostname (FQDN) of this system. When
# installing this instance with GSSAPI authentication behind a load balancer, set
# this parameter to the FQDN of the load balancer and, additionally, set
# "strict_host_checking" to "false".
# Default value: ldapserver1.test.net
;full_machine_name = ldapserver1.test.net

# selinux (bool)
# Description: Enables SELinux detection and integration during the installation
# of this instance. If set to "True", dscreate auto-detects whether SELinux is
# enabled. Set this parameter only to "False" in a development environment.
# Default value: True
;selinux = True
> sudo dscreate from-file TEMPLATE.txt
> sudo dsctl localhost status
Instance "localhost" is running
suffix = dc=LDAP1,dc=COM
> sudo dsctl LDAP1 remove --do-it
> systemctl status --no-pager --full dirsrv@LDAP1.service
   ● dirsrv@LDAP1.service - 389 Directory Server LDAP1.
     Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled)
     Active: active (running) since Thu 2021-03-11 08:55:28 PST; 2h 7min ago
    Process: 4451 ExecStartPre=/usr/lib/dirsrv/ds_systemd_ask_password_acl
       /etc/dirsrv/slapd-LDAP1/dse.ldif (code=exited, status=0/SUCCESS)
   Main PID: 4456 (ns-slapd)
     Status: "slapd started: Ready to process requests"
      Tasks: 26
     CGroup: /system.slice/system-dirsrv.slice/dirsrv@LDAP1.service
             └─4456 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-LDAP1 -i /run/dirsrv/slapd-LDAP1.pid
> sudo systemctl start dirsrv@LDAP1.service
> sudo systemctl stop dirsrv@LDAP1.service
> sudo systemctl restart dirsrv@LDAP1.service
> sudo dsctl LDAP1 status
> sudo dsctl LDAP1 stop
> sudo dsctl LDAP1 restart
> sudo dsctl LDAP1 start
# /root/.dsrc file for administering the LDAP1 instance

[LDAP1] 1

uri = ldapi://%%2fvar%%2frun%%2fslapd-LDAP1.socket 2
basedn = dc=LDAP1,dc=COM
binddn = cn=Directory Manager
 # does not match all but joe
# instead, it does not match anyone
sudoUser: !joe

# does not match all but joe
# instead, it matches everyone including Joe
sudoUser: ALL
sudoUser: !joe
> sudo firewall-cmd --add-service=ldap --zone=internal
> sudo firewall-cmd --add-service=ldaps --zone=internal
> sudo firewall-cmd --runtime-to-permanent
> sudo tar caf \
config_slapd-INSTANCE_NAME-$(date +%Y-%m-%d_%H-%M-%S).tar.gz \
/etc/dirsrv/slapd-INSTANCE_NAME/
> sudo old /etc/dirsrv/slapd-INSTANCE_NAME/
> sudo tar -xvzf \
config_slapd-INSTANCE_NAME-DATE.tar.gz
> sudo cp -r etc/dirsrv/slapd-INSTANCE_NAME \
/etc/dirsrv/slapd-INSTANCE_NAME
> sudo dsctl INSTANCE_NAME stop
Instance "INSTANCE_NAME" has been stopped
> sudo dsctl INSTANCE_NAME db2bak
db2bak successful
/var/lib/dirsrv/slapd-ldap1/bak/ldap1-2021_10_25_13_03_17
> sudo dsctl INSTANCE_NAME bak2db \
/var/lib/dirsrv/slapd-INSTANCE_NAME/bak/INSTANCE_NAME-DATE/
bak2db successful
> sudo dsctl INSTANCE_NAME start
Instance "INSTANCE_NAME" has been started
> sudo dsctl INSTANCE_NAME db2ldif --replication userRoot
ldiffile: /var/lib/dirsrv/slapd-INSTANCE_NAME/ldif/INSTANCE_NAME-userRoot-DATE.ldif
db2ldif successful
> sudo dsctl ldif2db userRoot \
/var/lib/dirsrv/slapd-INSTANCE_NAME/ldif/INSTANCE_NAME-userRoot-DATE.ldif
> sudo dsctl INSTANCE_NAME start
> sudo dsconf INSTANCE_NAME backup create
The backup create task has finished successfully
> sudo dsconf INSTANCE_NAME backup restore \
/var/lib/dirsrv/slapd-INSTANCE_NAME/bak/INSTANCE_NAME-DATE
> sudo dsidm LDAP1 user list
> sudo dsidm LDAP1 group list
> sudo dsidm LDAP1 user get USER
> sudo dsidm LDAP1 group get GROUP
> sudo dsidm LDAP1 group members GROUP
> sudo dsidm LDAP1 user create --uid wilber \
  --cn wilber --displayName 'Wilber Fox' --uidNumber 1001 --gidNumber 101 \
  --homeDirectory /home/wilber
> sudo dsidm LDAP1 user get wilber
dn: uid=wilber,ou=people,dc=LDAP1,dc=COM
[...]
> sudo dsidm LDAP1 account reset_password \
  uid=wilber,ou=people,dc=LDAP1,dc=COM
reset password for uid=wilber,ou=people,dc=LDAP1,dc=COM
> ldapwhoami -D uid=wilber,ou=people,dc=LDAP1,dc=COM -W
Enter LDAP Password: PASSWORD
dn: uid=wilber,ou=people,dc=LDAP1,dc=COM
> sudo dsidm LDAP1 group create
Enter value for cn : SERVER_ADMINS
> sudo dsidm LDAP1 group add_member SERVER_ADMINS \
uid=wilber,ou=people,dc=LDAP1,dc=COM
added member: uid=wilber,ou=people,dc=LDAP1,dc=COM
> sudo dsidm LDAP1 group remove_member SERVER_ADMINS \
uid=wilber,ou=people,dc=LDAP1,dc=COM
> sudo dsidm LDAP1 user delete \
uid=wilber,ou=people,dc=LDAP1,dc=COM
> sudo dsidm LDAP1 group delete SERVER_ADMINS
> sudo dsconf -D "cn=Directory Manager" ldap://LDAPSERVER1 plugin list
Enter password for cn=Directory Manager on ldap://LDAPSERVER1: PASSWORD

7-bit check
Account Policy Plugin
Account Usability Plugin
ACL Plugin
ACL preoperation
[...]
> sudo dsconf -D "cn=Directory Manager" ldap://LDAPSERVER1 plugin memberof enable
dsconf instance plugin: error: invalid choice: 'MemberOf' (choose from
'memberof', 'automember', 'referential-integrity', 'root-dn', 'usn',
'account-policy', 'attr-uniq', 'dna', 'linked-attr', 'managed-entries',
'pass-through-auth', 'retro-changelog', 'posix-winsync', 'contentsync', 'list',
'show', 'set')
> sudo systemctl restart dirsrv@LDAPSERVER1.service
> sudo dsconf LDAP1 plugin memberOf set --scope dc=example,dc=com
Successfully changed the cn=MemberOf Plugin,cn=plugins,cn=config
> sudo dsidm LDAP1 user modify suzanne add:objectclass:nsmemberof
Successfully modified uid=suzanne,ou=people,dc=ldap1,dc=com
> sudo dsidm LDAP1 user get suzanne
dn: uid=suzanne,ou=people,dc=ldap1,dc=com
cn: suzanne
displayName: Suzanne Geeko
gidNumber: 102
homeDirectory: /home/suzanne
memberOf: cn=SERVER_ADMINS,ou=groups,dc=ldap1,dc=com
> sudo dsconf LDAP1 plugin memberof fixup -f '(objectClass=*)' dc=LDAP1,dc=COM
> sudo zypper in sssd sssd-ldap
> sudo old /etc/sssd/sssd.conf
> sudo cd /etc/sssd
> sudo dsidm LDAP1 client_config sssd.conf
[sssd]
services = nss, pam, ssh, sudo
config_file_version = 2
domains = default

[nss]
homedir_substring = /home

[domain/default]
# If you have large groups (for example, 50+ members),
# you should set this to True
ignore_group_members = False
debug_level=3
cache_credentials = True
id_provider = ldap
auth_provider = ldap
access_provider = ldap
chpass_provider = ldap

ldap_schema = rfc2307bis
ldap_search_base = dc=example,dc=com
# We strongly recommend ldaps
ldap_uri = ldaps://ldap.example.com
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/ldap.crt
ldap_access_filter = (|(memberof=cn=<login group>,ou=Groups,dc=example,dc=com))
enumerate = false
access_provider = ldap

ldap_user_member_of = memberof
ldap_user_gecos = cn
ldap_user_uuid = nsUniqueId
ldap_group_uuid = nsUniqueId
ldap_account_expire_policy = rhds
ldap_access_order = filter, expire
# add these lines to /etc/ssh/sshd_config
#  AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
#  AuthorizedKeysCommandUser nobody
ldap_user_ssh_public_key = nsSshPublicKey
> sudo chown root:root /etc/sssd/sssd.conf
> sudo chmod 600 /etc/sssd/sssd.conf
passwd: compat sss
group:  compat sss
shadow: compat sss
> sudo pam-config -a --sss
> sudo pam-config -q --sss
auth:
account:
password:
session:
> sudo c_rehash /etc/openldap/certs
> sudo systemctl enable --now sssd
> sudo slaptest -f /etc/openldap/slapd.conf -F /root/slapd.d
> sudo ls /root/slapd.d/*

/root/slapd.d/cn=config.ldif

/root/slapd.d/cn=config:
cn=module{0}.ldif  cn=schema.ldif                 olcDatabase={0}config.ldif
cn=schema          olcDatabase={-1}frontend.ldif  olcDatabase={1}mdb.ldif
> sudo slapcat -f /etc/openldap/slapd.conf -b dc=LDAP1,dc=COM \
-l /root/LDAP1-COM.ldif
> sudo openldap_to_ds LDAP1\
/root/slapd.d /root/LDAP1-COM.ldif.ldif
Examining OpenLDAP Configuration ...
Completed OpenLDAP Configuration Parsing.
Examining Ldifs ...
Completed Ldif Metadata Parsing.
The following migration steps will be performed:
 * Schema Skip Unsupported Attribute -> otherMailbox (0.9.2342.19200300.100.1.22)
 * Schema Skip Unsupported Attribute -> dSAQuality (0.9.2342.19200300.100.1.49)
 * Schema Skip Unsupported Attribute -> singleLevelQuality (0.9.2342.19200300.100.1.50)
 * Schema Skip Unsupported Attribute -> subtreeMinimumQuality (0.9.2342.19200300.100.1.51)
 * Schema Skip Unsupported Attribute -> subtreeMaximumQuality (0.9.2342.19200300.100.1.52)
 * Schema Create Attribute -> suseDefaultBase (SUSE.YaST.ModuleConfig.Attr:2)
 * Schema Create Attribute -> suseNextUniqueId (SUSE.YaST.ModuleConfig.Attr:3)
[...]
 * Schema Create ObjectClass -> suseDhcpConfiguration (SUSE.YaST.ModuleConfig.OC:10)
 * Schema Create ObjectClass -> suseMailConfiguration (SUSE.YaST.ModuleConfig.OC:11)
 * Database Reindex -> dc=example,dc=com
 * Database Import Ldif -> dc=example,dc=com from example.ldif -
excluding entry attributes = [{'structuralobjectclass', 'entrycsn'}]
No actions taken. To apply migration plan, use '--confirm'
  > sudo openldap_to_ds LDAP1 /root/slapd.d /root/LDAP1-COM.ldif --confirm
Starting Migration ... This may take some time ...
migration: 1 / 40 complete ...
migration: 2 / 40 complete ...
migration: 3 / 40 complete ...
[...]
Index task index_all_05252021_120216 completed successfully
post: 39 / 40 complete ...
post: 40 / 40 complete ...
🎉 Migration complete!
----------------------
You should now review your instance configuration and data:
 * [ ] - Create/Migrate Database Access Controls (ACI)
 * [ ] - Enable and Verify TLS (LDAPS) Operation
 * [ ] - Schedule Automatic Backups
 * [ ] - Verify Accounts Can Bind Correctly
 * [ ] - Review Schema Inconistent ObjectClass -> pilotOrganization (0.9.2342.19200300.100.4.20)
 * [ ] - Review Database Imported Content is Correct -> dc=ldap1,dc=com
 ┌─────────────────┐
 │                 │
 │   LDAP client   │
 │                 │
 └─────────────────┘
          │
      binds to
          │
          ▼
 ┌─────────────────┐
 │    OpenLDAP     │
 │     server      │
 │                 │
 └─────────────────┘
          │
          │
          ▼
 ┌─────────────────┐
 │                 │
 │    saslauthd    │
 │                 │
 └─────────────────┘
          │
          │
          ▼
 ┌─────────────────┐
 │                 │
 │  External auth  │
 │                 │
 └─────────────────┘
> sudo testsaslauthd -u USERNAME@REALM -p PASSWORD
> sudo zypper install -y pam_saslauthd
> sudo dsconf INSTANCE plugin pam-pass-through-auth show
> sudo dsconf INSTANCE plugin pam-pass-through-auth list
  ┌─────────────────┐
  │                 │
  │   LDAP client   │
  │                 │
  └─────────────────┘
           │
       binds to
           │
           ▼
  ┌─────────────────┐
  │     389-DS      │
  │     server      │
  │                 │
  └─────────────────┘
           │
           ▼
  ┌─────────────────┐
  │                 │
  │  pam saslauthd  │
  │                 │
  └─────────────────┘
           │
           ▼
  ┌─────────────────┐
  │                 │
  │    saslauthd    │
  │                 │
  └─────────────────┘
           │
           │
           ▼
  ┌─────────────────┐
  │                 │
  │  External auth  │
  │                 │
  └─────────────────┘
> sudo dsconf INSTANCE plugin pam-passt-through-auth status
> sudo dsconf INSTANCE plugin pam-pass-through-auth enable
> sudo dsconf INSTANCE plugin pam-pass-through-auth show
> sudo dsctl INSTANCE_NAME tls remove-cert Self-Signed-CA
> sudo dsctl INSTANCE_NAME tls remove-cert Server-Cert

> sudo sudo dsctl INSTANCE_NAME tls import-ca
   /path/to/CA/in/PEM/format/CA.pem  NICKNAME_FOR_CA

> sudo dsctl INSTANCE_NAME tls import-server-key-cert
  /path/to/SERVER.pem /path/to/SERVER.key
> sudo systemctl restart dirsrv@INSTANCE-NAME..service

┌────┐       ┌────┐
│ S1 │◀─────▶│ S2 │
└────┘       └────┘
┌────┐       ┌────┐
│ S1 │◀─────▶│ S2 │
└────┘       └────┘
   ▲            ▲
   │            │
   ▼            ▼
┌────┐       ┌────┐
│ S3 │◀─────▶│ S4 │
└────┘       └────┘
                  ┌────┐       ┌────┐
                  │ S1 │◀─────▶│ S2 │
                  └────┘       └────┘
                     ▲            ▲
                     │            │
   ┌────────────┬────┴────────────┴─────┬────────────┐
   │            │                       │            │
   ▼            ▼                       ▼            ▼
┌────┐       ┌────┐                  ┌────┐       ┌────┐
│ S3 │◀─────▶│ S4 │                  │ S5 │◀─────▶│ S6 │
└────┘       └────┘                  └────┘       └────┘
             ┌────┐       ┌────┐
             │ S1 │◀─────▶│ S2 │
             └────┘       └────┘
                │            │
                │            │
   ┌────────────┼────────────┼────────────┐
   │            │            │            │
   ▼            ▼            ▼            ▼
┌────┐       ┌────┐       ┌────┐       ┌────┐
│ S3 │       │ S4 │       │ S5 │       │ S6 │
└────┘       └────┘       └────┘       └────┘
> sudo dsconf INSTANCE-NAME replication create-manager
> sudo dsconf INSTANCE-NAME replication enable \
--suffix dc=example,dc=com \
--role supplier --replica-id 1 --bind-dn "cn=replication manager,cn=config"
> sudo dsconf INSTANCE-NAME replication create-manager
> sudo dsconf INSTANCE-NAME replication enable \
--suffix dc=example,dc=com \
--role supplier --replica-id 2 --bind-dn "cn=replication manager,cn=config"
> sudo dsconf INSTANCE-NAME repl-agmt create \
--suffix dc=example,dc=com \
--host=RW2 --port=636 --conn-protocol LDAPS --bind-dn "cn=replication manager,cn=config" \
--bind-passwd PASSWORD --bind-method SIMPLE RW1_to_RW2
> sudo dsconf INSTANCE-NAME repl-agmt init \
--suffix dc=example,dc=com RW1_to_RW2
> sudo dsconf INSTANCE-NAME repl-agmt init-status \
--suffix dc=example,dc=com RW1_to_RW2
> sudo dsconf INSTANCE-NAME repl-agmt create \
--suffix dc=example,dc=com \
--host=RW1 --port=636 --conn-protocol LDAPS \
--bind-dn "cn=replication manager,cn=config" --bind-passwd PASSWORD \
--bind-method SIMPLE RW2_to_RW1
> sudo dsconf INSTANCE-NAME repl-agmt status \
--suffix dc=example,dc=com \
--bind-dn "cn=replication manager,cn=config" \
--bind-passwd PASSWORD RW2_to_RW1
> sudo dsconf INSTANCE_NAME replication create-manager
> sudo  dsconf INSTANCE_NAME \
replication enable --suffix dc=EXAMPLE,dc=COM \
--role consumer --bind-dn "cn=replication manager,cn=config"
> sudo dsconf INSTANCE_NAME \
repl-agmt create --suffix dc=EXAMPLE,dc=COM \
--host=RO3 --port=636 --conn-protocol LDAPS \
--bind-dn "cn=replication manager,cn=config" --bind-passwd PASSWORD
--bind-method SIMPLE RW1_to_RO3
> sudo dsconf INSTANCE_NAME repl-agmt create \
--suffix dc=EXAMPLE,dc=COM \
--host=RO3 --port=636 --conn-protocol LDAPS \
--bind-dn "cn=replication manager,cn=config" --bind-passwd PASSWORD \
--bind-method SIMPLE RW2_to_RO3
> sudo dsconf INSTANCE_NAME repl-agmt init
--suffix dc=EXAMPLE,dc=COM RW2_to_RO3
> sudo dsconf -D "cn=Directory Manager" ldap://RW2 replication monitor
> sudo dsconf -D "cn=Directory Manager" ldap://RO3 replication monitor
> sudo dsconf -D "cn=Directory Manager" ldap://RW1 replication monitor
> sudo dsctl INSTANCE_NAME healthcheck --check replication
> sudo dsctl -v INSTANCE_NAME healthcheck --check replication
> sudo dsctl INSTANCE_NAME healthcheck --list-checks
config:hr_timestamp
config:passwordscheme
backends:userroot:cl_trimming
backends:userroot:mappingtree
backends:userroot:search
backends:userroot:virt_attrs
encryption:check_tls_version
fschecks:file_perms
[...]
> sudo dsctl INSTANCE_NAME healthcheck \
--check monitor-disk-space:disk_space tls:certificate_expiration
> sudo dsconf INSTANCE_NAME repl-agmt disable \
--suffix dc=EXAMPLE,dc=COM RW2_to_RW1
> sudo dsconf INSTANCE_NAME repl-agmt enable \
--suffix dc=EXAMPLE,dc=COM RW2_to_RW1
> sudo dsconf INSTANCE_NAME \
replication set-changelog --max-age 7d \
--suffix dc=EXAMPLE,dc=COM
> sudo dsconf INSTANCE_NAME repl-agmt delete \
--suffix dc=EXAMPLE,dc=COM RW1_to_RW2
> sudo dsconf INSTANCE_NAME repl-agmt delete \
--suffix dc=EXAMPLE,dc=COM RW2_to_RW1
> sudo dsconf INSTANCE_NAME repl-agmt delete \
--suffix dc=EXAMPLE,dc=COM RW2_to_RO3
> sudo systemctl stop dirsrv@INSTANCE_NAME.service
> sudo dsconf INSTANCE_NAME repl-tasks cleanallruv \
--suffix dc=EXAMPLE,dc=COM --replica-id 2
> sudo dsconf INSTANCE_NAME repl-tasks list-cleanruv-tasks
┌────────┐     ┌────────┐         ┌────────┐     ┌────────┐
│        │     │        │         │        │     │        │
│ 389-ds │◀───▶│ 389-ds │◀ ─ ─ ─ ▶│   AD   │◀───▶│   AD   │
│        │     │        │         │        │     │        │
└────────┘     └────────┘         └────────┘     └────────┘
    ▲               ▲                  ▲             ▲
    │               │                  │             │
    ▼               ▼                  ▼             ▼
┌────────┐     ┌────────┐         ┌────────┐     ┌────────┐
│        │     │        │         │        │     │        │
│ 389-ds │◀───▶│ 389-ds │         │   AD   │◀───▶│   AD   │
│        │     │        │         │        │     │        │
└────────┘     └────────┘         └────────┘     └────────┘
> sudo dsconf INSTANCE-NAME repl-winsync-agmt create --suffix dc=example,dc=com \
  --host AD-HOSTNAME --port 636 --conn-protocol LDAPS \
  --bind-dn "cn=SERVICE-ACCOUNT,cn=USERS,dc=AD,dc=EXAMPLE,dc=COM" \
  --bind-passwd "PASSWORD" --win-subtree "cn=USERS,dc=AD,dc=EXAMPLE,dc=COM" \
  --ds-subtree ou=AD,dc=EXAMPLE,dc=COM --one-way-sync fromWindows \
  --sync-users=on --sync-groups=on --move-action delete \
  --win-domain AD-DOMAIN adsync_agreement
> sudo dsconf INSTANCE-NAME repl-winsync-agmt init --suffix dc=example,dc=com adsync_agreement
> sudo dsconf INSTANCE-NAME repl-winsync-agmt init-status --suffix dc=example,dc=com adsync_agreement
> sudo dsconf INSTANCE-NAME repl-winsync-agmt status --suffix dc=example,dc=com adsync_agreement
> sudo dsconf INSTANCE-NAME repl-winsync-agmt disable --suffix dc=example,dc=com adsync_agreement
> sudo dsconf INSTANCE-NAME repl-winsync-agmt enable --suffix dc=example,dc=com adsync_agreement
USER/INSTANCE@REALM
> ssh DOMAIN_NAME\\USER_NAME@HOST_NAME
> /usr/sbin/samba-gpupdate --rsop
Resultant Set of Policy
Computer Policy
GPO: Default Domain Policy
==========================================================
CSE: gp_cert_auto_enroll_ext
-----------------------------------------------------------
Policy Type: Auto Enrollment Policy
-----------------------------------------------------------
[ <CA NAME> ] =
[ CA Certificate ] =
----BEGIN CERTIFICATE----
<CERTIFICATE>
----END CERTIFICATE----
[ Auto Enrollment Server ] = <DNS NAME>
> getcert list
 Number of certificates and requests being tracked: 1.
 Request ID 'Machine':
 status: MONITORING
 stuck: no
 key pair storage: type=FILE,location='/var/lib/samba/private/certs/Machine.key'
 certificate: type=FILE,location='/var/lib/samba/certs/Machine.crt'
 CA: <CA NAME>
 issuer: CN=<CA NAME>
 subject: CN=<HOSTNAME>
 expires: 2017-08-15 17:37:02 UTC
 dns: <hostname>
 key usage: digitalSignature,keyEncipherment
 eku: id-kp-clientAuth,id-kp-serverAuth
 certificate template/profile: Machine
# zypper in freeradius-server freeradius-server-utils
# cd /etc/raddb/certs
# ./bootstrap
# radiusd -X
[...]
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 54435
Listening on proxy address :: port 58415
Ready to process requests
> radiusd -X | tee radiusd.text
bob   Cleartext-Password := "hello"
Reply-Message := "Hello, %{User-Name}"
> radtest bob hello 127.0.0.1 0 testing123
Sent Access-Request Id 241 from 0.0.0.0:35234 to 127.0.0.1:1812 length 73
        User-Name = "bob"
        User-Password = "hello"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
        Message-Authenticator = 0x00
        Cleartext-Password = "hello"
Received Access-Accept Id 241 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
(3) pap: Login attempt with password
(3) pap: Comparing with "known good" Cleartext-Password
(3) pap: User authenticated successfully
(3)     [pap] = ok
[...]
(3) Sent Access-Accept Id 241 from 127.0.0.1:1812 to 127.0.0.1:35234 length 0
(3) Finished request
Waking up in 4.9 seconds.
(3) Cleaning up request packet ID 241 with timestamp +889
client private-network-1 }
  ipaddr          = 192.0.2.0/24
  secret          = testing123-1
  {
> radtest bob hello 192.168.2.100 0 testing123-1
> sudo groupadd mmedia_all
> sudo usermod -a -G mmedia_all tux
> cat /etc/polkit-1/rules.d/10-mount.rules
polkit.addRule(function(action, subject) {
 if (action.id =="org.freedesktop.udisks2.eject-media"
  && subject.isInGroup("mmedia_all")) {
   return polkit.Result.YES;
  }
});

polkit.addRule(function(action, subject) {
 if (action.id =="org.freedesktop.udisks2.filesystem-mount"
  && subject.isInGroup("mmedia_all")) {
   return polkit.Result.YES;
  }
});
# systemctl restart udisks2
# systemctl restart polkit
> sudo  zypper install usbguard
# usbguard generate-policy > /etc/usbguard/rules.conf
# systemctl enable --now usbguard.service
usbguard allow-device 6
usbguard block-device 6
IPCAllowedUsers=root joe
IPCAllowedGroups=wheel
# zypper packages -i
# zypper info PACKAGE_NAME
# zypper rm -D PACKAGE_NAME
# zypper rm -u PACKAGE_NAME
# Additional custom hardening
/etc/security/access.conf       root:root       0400
/etc/sysctl.conf                root:root       0400
/root/                          root:root       0700
PERMISSION_SECURITY="easy local"
> sudo chmod 755 /home
> sudo bash -c 'for dir in /home/*; do \
echo "Changing permissions of directory $dir"; chmod 700 "$dir"; done'
# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
# home directories.
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
HOME_MODE      0700
> umask
022
> touch a
> mkdir b
> ls -on
total 16
-rw-r--r--. 1 17086    0 Nov 29 15:05 a
drwxr-xr-x. 2 17086 4096 Nov 29 15:05 b
> umask 111
> touch c
> mkdir d
> ls -on
total 16
-rw-rw-rw-. 1 17086    0 Nov 29 15:05 c
drw-rw-rw-. 2 17086 4096 Nov 29 15:05 d
> umask 037
> touch e
> mkdir f
> ls -on
total 16
-rw-r-----. 1 17086    0 Nov 29 15:06 e
drwxr-----. 2 17086 4096 Nov 29 15:06 f
# Default initial "umask" value used by login(1) on non-PAM enabled systems.
# Default "umask" value for pam_umask(8) on PAM enabled systems.
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
# home directories.
# 022 is the default value, but 027, or even 077, could be considered
# for increased privacy. There is no One True Answer here: each sysadmin
# must make up their mind.
UMASK           022
tux:x:1000:100:Tux Linux,UMASK=022:/home/tux:/bin/bash
# find /bin /boot /etc /home /lib /lib64 /opt /root /sbin \
  /srv /tmp /usr /var -type f -perm '/6000' -ls
# getcap -v /usr/bin/ping
/usr/bin/ping = cap_new_raw+eip
# find /bin /boot /etc /home /lib /lib64 /opt /root /sbin \
  /srv /tmp /usr /var -type f -perm -2 ! -type l -ls
> ls -ld /tmp
drwxrwxrwt 18 root root 16384 Dec 23 22:20 /tmp
# find /bin /boot /etc /home /lib /lib64 /opt /root /sbin /srv /tmp /usr /var -nouser -o -nogroup
> find /bin /lib /lib64 /usr -path /usr/local -prune -o -type f -a -exec /bin/sh -c "rpm -qf {} &> /dev/null || echo {}" \;
> gpg -e -a --cipher-algo AES256 -r UID FILE
> gpg -e -a --cipher-algo AES256 -r Tux secret.txt
> gpg -d -o DECRYPTED_FILE ENCRYPTED_FILE
> sudo zypper install rage-encryption
> rage-keygen -o ~/rage.key 2 ~/rage.pub
> cat file.pub
    Public key: age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e
>  cat file.key
    # created: 2023-05-30T16:29:20+05:30
    # public key: age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e
> rage -e -r PUBLIC_KEY -o ENCRYPTED_FILE FILE
> rage -e -r age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e -o test.txt.age test.txt
> rage -d -i ~/rage.key -o DECRYPTED_FILE ENCRYPTED_FILE FILE
> rage -d -i ~/rage.key -o test.txt.decrypted test.txt.age
> rage -e -p -o ENCRYPTED_FILE FILE
> rage -e -p -o test.txt.age test.txt
> rage -e -p -o ENCRYPTED_FILE FILE
> rage -e -p -o test.txt.age test.txt
>  ssh-keygen -t ed25519
>  rage -e -a -R PUBLIC_KEY_FILE -o ENCRYPTED_FILE FILE
>  rage -e -a -R id_ed25519.pub -o test.txt.age test.txt
>  rage -d -i SSH_PRIVATE_KEY_FILE -o DECRYPTED_FILEENCRYPTED_FILE
>  rage -d -i id_ed25519 -o test.txt.decrypted test.txt.age
rage -e -a -R FIRST_SSH_PUBLIC_KEY-r FIRST_RAGE_PUBLIC_KEY... -o ENCRYPTED_FILE FILE
rage -e -a -R id_ed25519.pub -r age1h8equ4vs5pyp8ykw0z8m9n8m3psy6swme52ztth0v66frgu65ussm8gq0t -o -r age1y2lc7x59jcqvrpf3ppmnj3f93ytaegfkdnl5vrdyv83l8ekcae4sexgwkg test.txt.age test.txt
# cryptctl init-server
# systemctl status cryptctl-server
# cryptctl encrypt
> lsblk -o NAME,MOUNTPOINT,UUID
NAME                        MOUNTPOINT          UUID
[...]
sdc
└─sdc1                                          PARTITION_UUID
  └─cryptctl-unlocked-sdc1  /secret-partition   UNLOCKED_UUID
# cryptctl list-keys
2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records
Total: 1 records (date and time are in zone EDT)
Used By     When                 UUID  Max.Users  Num.Users  Mount Point
IP_ADDRESS  2019-06-06 15:00:50  UUID  1          1          /secret-partition
2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records
Total: 1 records (date and time are in zone EDT)
Used By      When                 UUID  Max.Users  Num.Users  Mount Point
             2019-06-06 15:00:50  UUID  1          1          /secret-partition
# cryptctl list-keys
# cryptctl show-key UUID
# systemctl stop cryptctl-server
# crm cluster init -i NetDev -A AdminIP -n ClusterName
# ssh Node2
# crm cluster join -y Node1
# crm script verify cryptctl  \
cert-path=/etc/cryptctl/servertls/CertificateFileName \
cert-key-path=/etc/cryptctl/servertls/CertificateKeyFileName \
virtual-ip:ip=CrypServerIP \
filesystem:device=DevicePath
filesystem:fstype=FileSystemType
# crm script verify cryptctl  \
cert-path=/etc/cryptctl/servertls/CertificateFileName \
cert-key-path=/etc/cryptctl/servertls/CertificateKeyFileName \
virtual-ip:ip=CrypServerIP \
filesystem:device=DevicePath
filesystem:fstype=FileSystemType
# egrep -v ':\*|:\!' /etc/shadow | awk -F: '{print $1}'
# grep -v ':x:' /etc/passwd
# find / -path /proc -prune -o -user ACCOUNT -ls
# userdel -r ACCOUNT
# useradd -c "TEST_USER" -g USERS TEST
# id TEST
uid=509(test) gid=100(users) groups=100(users)
# grep TEST /etc/shadow
test:!!:12742:7:60:7:14::
# chage -M -1 SYSTEM_ACCOUNT_NAME
# chage -l SYSTEM_ACCOUNT_NAME
# chage -l TEST
Minimum: 7
Maximum: 60
Warning: 7
Inactive: 14
Last Change: Jan 11, 2015
Password Expires: Mar 12, 2015
Password Inactive: Mar 26, 2015
Account Expires: Never
# This file is autogenerated by pam-config. All changes
# will be overwritten.
> sudo pam-config -a --cracklib-minlen=8 --cracklib-retry=3 \
--cracklib-lcredit=-1 --cracklib-ucredit=-1 --cracklib-dcredit=-1 \
--cracklib-ocredit=-1 --cracklib
> sudo pam-config -a --pwhistory --pwhistory-remember=26
auth      required   pam_env.so
auth      required   pam_unix.so     try_first_pass
account   required   pam_unix.so     try_first_pass
password  requisite   pam_cracklib.so
password  required   pam_pwhistory.so        remember=26
password  optional   pam_gnome_keyring.so    use_authtok
password  required   pam_unix.so     use_authtok nullok shadow try_first_pass
session   required   pam_limits.so
session   required   pam_unix.so     try_first_pass
session   optional   pam_umask.so
auth required pam_tally2.so deny=6 unlock_time=600
#%PAM-1.0
auth     requisite      pam_nologin.so
auth     include        common-auth
auth     required       pam_tally2.so deny=6 unlock_time=600
account  include        common-account
account  required       pam_tally2.so
password include        common-password
session  required       pam_loginuid.so
session  include        common-session
#session  optional       pam_lastlog.so nowtmp showfailed
session  optional       pam_mail.so standard
auth required pam_tally2.so deny=6 even_deny_root unlock_time=600
auth required pam_tally2.so deny=6 root_unlock_time=120  unlock_time=600
> sudo pam_tally2 -u username
Login           Failures Latest failure     From
username            6    12/17/19 13:49:43  pts/1

> sudo pam_tally2 -r -u username
auth     requisite      pam_nologin.so
 auth     [user_unknown=ignore success=ok ignore=ignore auth_err=die default=bad] pam_securetty.so noconsole
 auth     include        common-auth
#
# This file contains the device names of tty lines (one per line,
# without leading /dev/) on which root is allowed to login.
#
tty1
PermitRootLogin no
systemctl restart sshd.service
#ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!
%wheel ALL=(ALL) ALL
usermod -aG wheel tux
wilber is not in the sudoers file.  This incident will be reported.
# /etc/profile.d/timeout.sh for SUSE Linux
#
# Timeout in seconds until the bash/ksh session is terminated
# in case of inactivity.
# 24h = 86400 sec
readonly TMOUT=86400
# ulimit -a
UseLogin no
UsePAM no
PasswordAuthentication no
PubkeyAuthentication yes
oracle           soft    nofile          4096
oracle           hard    nofile          63536
# ulimit -n 63536
session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so
# su - oracle
> ulimit -n
4096
# su - oracle
> ulimit -n
4096
> ulimit -n 63536
> ulimit -n
63536
# su - oracle
> cat >> ~oracle/.bash_profile << EOF
ulimit -n 63536
EOF
if ! /usr/bin/gdialog --yesno '\nThis system is classified...\n' 10 10; then
    /usr/bin/gdialog --infobox 'Aborting login'
    exit 1;
fi
tux > sudo touch /etc/cron.allow
tux > sudo echo "tux" >> /etc/cron.allow
tux > crontab -e
no crontab for tux - using an empty one
wilber > crontab -e
You (wilber) are not allowed to use this program (crontab)
See crontab(1) for more information
tux > sudo touch /etc/at.allow
tux > sudo echo "tux" >> /etc/at.allow
tux > at 00:00
at>
wilber > at 00:00
You do not have permission to use at.
# zypper in spectre-meltdown-checker
# spectre-meltdown-checker.sh
# spectre-meltdown-checker.sh --no-color| tee filename.txt
# cd /boot
# spectre-meltdown-checker.sh \
--no-color \
--kernel vmlinuz-6.4.0-150600.9-default \
--config config-6.4.0-150600.9-default \
--map System.map-6.4.0-150600.9-default| tee filename.txt
> pkaction -v --action-id=org.freedesktop.login1.reboot
org.freedesktop.login1.reboot:
  description:       Reboot the system
  message:           Authentication is required to allow rebooting the system
  vendor:            The systemd Project
  vendor_url:        http://www.freedesktop.org/wiki/Software/systemd
  icon:
  implicit any:      auth_admin_keep
  implicit inactive: auth_admin_keep
  implicit active:   yes
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig> 1

  <action id="org-opensuse-polkit-gparted"> 2
    <message>Authentication is required to run the GParted Partition Editor</message>
    <icon_name>gparted</icon_name>
    <defaults> 3
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
     < allow_active>auth_admin</allow_active>
    </defaults>
    <annotate 4
      key="org.freedesktop.policykit.exec.path">/usr/sbin/gparted</annotate>
    <annotate 4
      key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

</policyconfig>
/* Allow users in admin group to run GParted without authentication */
polkit.addRule(function(action, subject) {
    if (action.id == "org.opensuse.policykit.gparted" &&
        subject.isInGroup("admin")) {
        return polkit.Result.YES;
    }
});
<action-id>     <auth_any>:<auth_inactive>:<auth_active>
<action-id>     <auth_all>
org.freedesktop.color-manager.modify-profile     auth_admin_keep
# /sbin/set_polkit_default_privs
-rwsr-xr-x  1 root shadow 80036 2004-10-02 11:08 /usr/bin/passwd
drwxrws--- 2 tux archive 48 Nov 19 17:12  backup
drwxrwxrwt 2 root root 1160 2002-11-19 17:15 /tmp
drwxr-x--- ... tux project3 ... mydir
# file: mydir
# owner: tux
# group: project3
user::rwx
group::r-x
other::---
# setfacl -m user:geeko:rwx,group:mascots:rwx mydir
# file: mydir
# owner: tux
# group: project3
user::rwx
user:geeko:rwx
group::r-x
group:mascots:rwx
mask::rwx
other::---
drwxrwx---+ ... tux project3 ... mydir
drwxr-x---+ ... tux project3 ... mydir
# file: mydir
# owner: tux
# group: project3
user::rwx
user:geeko:rwx          # effective: r-x
group::r-x
group:mascots:rwx       # effective: r-x
mask::r-x
other::---
> setfacl -d -m group:mascots:r-x mydir
> getfacl mydir

# file: mydir
# owner: tux
# group: project3
user::rwx
user:geeko:rwx
group::r-x
group:mascots:rwx
mask::rwx
other::---
default:user::rwx
default:group::r-x
default:group:mascots:r-x
default:mask::r-x
default:other::---
> mkdir mydir/mysubdir

getfacl mydir/mysubdir

# file: mydir/mysubdir
# owner: tux
# group: project3
user::rwx
group::r-x
group:mascots:r-x
mask::r-x
other::---
default:user::rwx
default:group::r-x
default:group:mascots:r-x
default:mask::r-x
default:other::---
-rw-r-----+ ... tux project3 ... mydir/myfile
# file: mydir/myfile
# owner: tux
# group: project3
user::rw-
group::r-x          # effective:r--
group:mascots:r-x   # effective:r--
mask::r--
other::---
Binlib     = p+i+n+u+g+s+b+m+c+md5+sha1
/sbin  Binlib
!/sbin/conf.d
# aide --config-check
# aide --config-check
35:syntax error:!
35:Error while reading configuration:!
Configuration error
# aide -i
# mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# aide --check
# aide --check
AIDE found differences between database and file system!!

Summary:
  Total number of files:        1992
  Added files:                  0
  Removed files:                0
  Changed files:                1
# aide --check -V
AIDE found differences between database and file system!!
Start timestamp: 2009-02-18 15:14:10

Summary:
  Total number of files:        1992
  Added files:                  0
  Removed files:                0
  Changed files:                1

---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/passwd

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /etc/passwd
  Mtime    : 2009-02-18 15:11:02              , 2009-02-18 15:11:47
  Ctime    : 2009-02-18 15:11:02              , 2009-02-18 15:11:47
# cp DVD1/suse/ARCH/aideVERSION.ARCH.rpm /srv/ftp
# cp DVD1/suse/ARCH/mhashVERSION.ARCH.rpm /srv/ftp
dud:ftp://ftp.example.com/aideVERSION.ARCH.rpm
dud:ftp://ftp.example.com/mhashVERSION.ARCH.rpm
info=ftp://ftp.example.com/info.txt
The authenticity of host '192.168.22.219 (192.168.22.219)'
   can't be established. ECDSA key fingerprint is
   SHA256:yXf6pjV26N0fegvEYIt3HgG95s3Q1X6WYRhtHLF99pUo.
   Are you sure you want to continue connecting (yes/no/[fingerprint])?
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:keNu/rJFWmpQu9B0SjIuo8NLjbeDY/x3Tktpl7oDJqo.
Please contact your system administrator.
Add correct host key in /home/geeko/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/geeko/.ssh/known_hosts:210
You can use following command to remove the offending key:
ssh-keygen -R 192.168.121.219 -f /home/geeko/.ssh/known_hosts
ECDSA host key for 192.168.121.219 has changed and you have requested strict
checking.
Host key verification failed.
#Port 22
Port 2022

#ListenAddress 0.0.0.0
ListenAddress 192.168.10.100
# Check if the file modes and ownership of the user’s files and
# home directory are correct before allowing them to login
StrictModes yes

# If your machine has more than one IP address, define which address or
# addresses it listens on
ListenAddress 192.168.10.100

# Allow only members of the listed groups to log in
AllowGroups ldapadmins backupadmins

# Or, deny certain groups. If you use both, DenyGroups is read first
DenyGroups users

# Allow or deny certain users. If you use both, DenyUsers is read first
AllowUsers user1 user2@example.com user3
DenyUsers user4 user5@192.168.10.10

# Allow root logins only with public key authentication
PermitRootLogin prohibit-password

# Disable password authentication and allow only public key authentication
# for all users
PasswordAuthentication no

# Length of time the server waits for a user to log in and complete the
# connection. The default is 120 seconds:
LoginGraceTime 60

# Limit the number of failed connection attempts. The default is 6
MaxAuthTries 4
> sudo sshd -t
> sudo systemctl reload sshd.service
> ssh suzanne@sun
> ssh suzanne@sun "df -h && du -sh  /home"
> ssh suzanne@sun "sudo nano /etc/ssh/sshd_config"
> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/tux/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in id_rsa
Your public key has been saved in id_rsa.pub
The key fingerprint is:
SHA256:z0uJIuc7Doy07bFTe1ppZHLVrkD/bWWlBAF/PcHjblU user@host2
The key's randomart image is:
+---[RSA 3072]----+
|          ..o... |
|           o . +E|
|        . . o +.=|
|       . o . o o+|
|  .   . S . . o +|
| . =  .= * + . = |
|  o *.o.= * . +  |
|   ..Bo+.. . .   |
|    oo==  .      |
+----[SHA256]-----+
> ssh-keygen -b 4096
> ssh-keygen -f backup-server-key -C "infrastructure backup server"
> ssh-keygen -t ed25519 -f ldap-server-key -C "Internal LDAP server"
> ls -l /etc/ssh
total 608
-rw------- 1 root root 577834 2021-05-06 04:48 moduli
-rw-r--r-- 1 root root   2403 2021-05-06 04:48 ssh_config
-rw-r----- 1 root root   3420 2021-05-06 04:48 sshd_config
-rw------- 1 root root   1381 2022-02-10 06:55 ssh_host_dsa_key
-rw-r--r-- 1 root root    604 2022-02-10 06:55 ssh_host_dsa_key.pub
-rw------- 1 root root    505 2022-02-10 06:55 ssh_host_ecdsa_key
-rw-r--r-- 1 root root    176 2022-02-10 06:55 ssh_host_ecdsa_key.pub
-rw------- 1 root root    411 2022-02-10 06:55 ssh_host_ed25519_key
-rw-r--r-- 1 root root     96 2022-02-10 06:55 ssh_host_ed25519_key.pub
-rw------- 1 root root   2602 2022-02-10 06:55 ssh_host_rsa_key
-rw-r--r-- 1 root root    568 2022-02-10 06:55 ssh_host_rsa_key.pub
> sudo rm /etc/ssh/ssh_host*
> sudo ssh-keygen -A
> cd /etc/ssh
> sudo ssh-keygen -b 4096 -f "SSH_HOST_RSA_2022_02"
> sudo ssh-keygen -t ed25519 -f "SSH_HOST_ED25519_2022_02"
# ssh-keygen -t rsa -f ssh_host_rsa_2022-01 -C "main server"
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ssh_host_rsa_2022-01
Your public key has been saved in ssh_host_rsa_2022-01.pub
The key fingerprint is:
SHA256:F1FIF2aqOz7D3mGdsjzHpH/kjUWZehBN3uG7FM4taAQ main server
The key's randomart image is:
+---[RSA 3072]----+
|         .Eo*.oo |
|          .B .o.o|
|          o . .++|
|         . o ooo=|
|        S . o +*.|
|         o o.oooo|
|       .o ++oo.= |
|       .+=o+o + .|
|       .oo++..   |
+----[SHA256]-----+

# ssh-keygen -t ed25519 -f ssh_host_ed25519_2022-01 -C "main server"
Generating public/private ed25519 key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ssh_host_ed25519_2022-01
Your public key has been saved in ssh_host_ed25519_2022-01.pub
The key fingerprint is:
SHA256:2p9K0giXv7WsRnLjwjs4hJ8EFcoX1FWR4nQz6fxnjxg main server
The key's randomart image is:
+--[ED25519 256]--+
|   .+o ...o+     |
| . .... o *      |
|  o..  o = o     |
|  ..   .. o      |
|   o. o S  .     |
|  . oo.*+   E o  |
|   + ++==..  = o |
|    = +oo= o. . .|
|     ..=+o=      |
+----[SHA256]-----+
## Old keys
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_ecdsa_key

## New replacement keys
HostKey /etc/ssh/ssh_host_rsa_2022-01
HostKey /etc/ssh/ssh_host_ed25519_2022-01
# systemctl restart sshd.service
UpdateHostKeys ask
StrictHostKeyChecking yes
The server has updated its host keys.
These changes were verified by the server's existing trusted key.
Deprecating obsolete hostkey: ED25519
SHA256:V28d3VpHgjsCoV04RBCZpLo5c0kEslCZDVdIUnCvqPI
Deprecating obsolete hostkey:
RSA SHA256:+NR4DVdbsUNsqJPIhISzx+eqD4x/awCCwijZ4a9eP8I
Accept updated hostkeys? (yes/no):yes
> cd ~/.ssh
> ssh-keygen -C "web server1" -f id-web1 -t rsa -b 4096
> ssh-copy-id -i id-web1 user@web1
> ssh -i id-web1 user@web1
Enter passphrase for key 'id-web1':
Last login: Sat Jul 11 11:09:53 2022 from 192.168.10.122
Have a lot of fun...
> sudo ssh-keygen -t ed25519 -f /ca-ssh-hosts/ca-host-sign-key -C "signing key for host certificates"
Generating public/private ed25519 key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ca-host-sign-key
Your public key has been saved in ca-host-sign-key.pub
The key fingerprint is:
SHA256:STuQ7HgDrPcEa7ybNIW0n6kPbj28X5HN8GgwllBbAt0
 signing key for host certificates
The key's randomart image is:
+--[ED25519 256]--+
|      o+o..      |
|   . . o.=E      |
|    = + B .      |
|   + O + = B     |
|  . O * S = +    |
|   o B + o .     |
|    =o=   .      |
|   o.*+  .       |
|   .=.o+.        |
+----[SHA256]-----+
> sudo ssh-keygen -t ed25519 -f /ca-ssh-users/ca-user-sign-key -C "signing key for user certificates"
Generating public/private ed25519 key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ca-user-sign-key
Your public key has been saved in ca-user-sign-key.pub
The key fingerprint is:
SHA256:taYj8tTnjkzgfHRvQ6HTj8a37PY6rwv96V1x+GHRjIk signing key for user certificates
The key's randomart image is:
+--[ED25519 256]--+
|                 |
|             . +.|
|          . E o.o|
|         . + . ..|
|      . S * o .+.|
|     o + + = +..+|
|    . = * . O + o|
|     + = = o =oo+|
|      . o.o  oOX=|
+----[SHA256]-----+
TrustedUserCAKeys /etc/ssh/ca-user-sign-key.pub
> sudo ssh-keygen -s /ca-ssh-hosts/ca-host-sign-key \
   -n venus,venus.example.com -I "db-server host cert" \
   -h -V +4w /etc/ssh/ssh_host_ed25519_key.pub
Enter passphrase:
Signed host key /etc/ssh/ssh_host_ed25519_key-cert.pub: id
"db-server host cert" serial 0 for venus,venus.example.com
valid from 2022-08-08T14:20:00 to 2022-09-05T15:21:19
> ssh-keygen -Lf /etc/ssh/ssh_host_ed25519_key-cert.pub
 /etc/ssh/ssh_host_ed25519_key-cert.pub:
        Type: ssh-ed25519-cert-v01@openssh.com host certificate
        Public key: ED25519-CERT SHA256:/
         U7C+qABXYyuvueUuhFKzzVINq3d7IULRLwBstvVC+Q
        Signing CA: ED25519 SHA256:
         STuQ7HgDrPcEa7ybNIW0n6kPbj28X5HN8GgwllBbAt0 (using ssh-ed25519)
        Key ID: "db-server host cert"
        Serial: 0
        Valid: from 2022-08-08T14:20:00 to 2022-09-05T15:21:19
        Principals:
                venus
                venus.example.com
        Critical Options: (none)
        Extensions: (none)
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
> sudo systemctl restart sshd.service
@cert-authority db,db.example.com ssh-ed25519
 AAAAC3NzaC1lZDI1NTE5AAAAIH1pF6DN4BdsfUKWuyiGt/leCvuZ/fPu
 YxY7+4V68Fz0 signing key for user certificates
> sudo ssh-keygen /ca-ssh-hosts/ca-user-sign-key -I "suzanne's cert" -n suzanne -V +52w user-key.pub
 Signed user key .ssh/ed25519key-cert.pub: id "suzanne's cert" serial 0
 for suzanne valid from 2022-09-14T12:57:00 to 2023-09-13T12:58:21
ssh-ed25519-cert-v01@openssh.com
    AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIK6hyvFAhFI+0hkKehF/
    506fD1VdcW29ykfFJn1CPK9lAAAAIAawaXbbEFiQOAe5LGclrCHSLWbEeUauK5+CAuhTJyz0
    AAAAAAAAAAAAAAACAAAAE2RiLXNlcnZlciBob3N0IGNlcnQAAAAeAAAABXZlbnVzAAAAEXZl
    bnVzLmV4YW1wbGUuY29tAAAAAGMabhQAAAAAYz9YgQAAAAAAAAAAAAAAAAAAADMAAAALc3No
    LWVkMjU1MTkAAAAgfWkXoM3gF2x9Qpa7KIa3+V4K+5n98+5jFjv7hXrwXPQAAABTAAAAC3Nz
    aC1lZDI1NTE5AAAAQI+mbJsQjt/9bLiURse8DF3yTa6Yk3HpoE2uf9FW/
    KeLsw2wPeDv0d6jv49Wgr5T3xHYPf+VPJQW35ntFiHTlQg= root@db
RevokedKeys /etc/ssh/revoked_keys
> ssh-add ~/.otherkeys/my_key
> ssh-add -L
eval "$(ssh-agent)"
ssh-add
> ssh-add id_rsa id_ed25519
if [ -f ~/.xinitrc.template ]; then mv ~/.xinitrc.template ~/.xinitrc; \
else cp /etc/skel/.xinitrc.template ~/.xinitrc; fi
# if test -S "$SSH_AUTH_SOCK" -a -x "$SSH_ASKPASS"; then
#       ssh-add < /dev/null
# fi
> ssh-keygen -pf ~/.ssh/server1
Enter old passphrase:
Key has comment 'shared videos server1'
Enter new passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved with the new passphrase.
> ssh-keygen -lf ldap-server
256 SHA256:W45lbmj24ZoASbrqW0q9+NhF04muvfKZ+FkRa2cCiqo comment (ED25519)
> ssh-keygen -lvf ldap-server
256 SHA256:W45lbmj24ZoASbrqW0q9+NhF04muvfKZ+FkRa2cCiqo comment (ED25519)
+--[ED25519 256]--+
|                 |
|                 |
|    .. .         |
|  .o..+ +        |
| ...o+ BSo+      |
|. ..o.o =X       |
|...o o..* =      |
|o.*.* =+ = .     |
|E*o*+O. o.o      |
+----[SHA256]-----+
> ssh wilber@sun
Password:
Last login: Tue May 10 11:29:06 2022 from 192.168.163.13
Have a lot of fun...

wilber@sun>  gnome-mines
> echo $XDG_SESSION_TYPE
x11
> echo $XDG_SESSION_TYPE
wayland
> loginctl show-session "$XDG_SESSION_ID" -p Type
Type=x11

> loginctl show-session "$XDG_SESSION_ID" -p Type
Type=wayland
> scp ~/MyLetter.tex tux@sun:/tmp 1
> scp tux@sun:/tmp/MyLetter.tex ~ 2
> scp -r src/ sun:backup/
> sftp sun
Enter passphrase for key '/home/tux/.ssh/id_rsa':
Connected to sun.
sftp> help
Available commands:
bye                                Quit sftp
cd path                            Change remote directory to 'path'
[...]
Subsystem sftp /usr/lib/ssh/sftp-server -u 0002
Subsystem sftp /usr/lib/ssh/sftp-server -m 600
> sudo journalctl -u sshd
# ssh -L 25:sun:25 jupiter
# ssh -L 110:sun:110 jupiter
# sudo zypper -n in fail2ban firewalld
# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
vi /etc/fail2ban/jail.local
#  systemctl enable fail2ban
#  systemctl start fail2ban
#  systemctl status fail2ban.service
# firewall-cmd --runtime-to-permanent
# firewall-cmd --reload
# systemctl reload firewalld
# firewall-cmd --zone=public --list-interfaces
eth0
# firewall-cmd --get-zone-of-interface=eth0
public
# firewall-cmd --zone=internal --add-interface=eth0
# firewall-cmd --zone=internal --change-interface=eth0
# firewall-cmd --get-default-zone
dmz
# firewall-cmd --set-default-zone=public
# firewall-cmd --get-services
[...] dhcp dhcpv6 dhcpv6-client dns docker-registry [...]
# firewall-cmd --info-service dhcp
dhcp
  ports: 67/udp
  protocols:
  source-ports:
  modules:
  destination:
# firewall-cmd --add-service=http --zone=internal
# firewall-cmd --add-port=8000/tcp --zone=internal
# firewall-cmd --add-service=imap --zone=internal --timeout=5m
# firewall-cmd  --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 \
    -p tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
# firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" \
    source address="192.168.2.4" drop'
# firewall-cmd --zone=internal --add-masquerade
# firewall-cmd --zone=public \
    --add-forward-port=port=80:proto=tcp:toport=80:toaddr=192.168.1.10
options nfs callback_tcpport=21005
# firewall-cmd --permanent --new-service=nfs-rpc
# firewall-cmd --permanent --service=nfs-rpc --set-description="NFS related, statically configured RPC ports"
# add UDP and TCP ports for the given sequence
# for port in 21001 21002 21003 21004; do
    firewall-cmd --permanent --service=nfs-rpc --add-port ${port}/udp --add-port ${port}/tcp
done
# the callback port is TCP only
# firewall-cmd --permanent --service=nfs-rpc --add-port 21005/tcp

# show the complete definition of the new custom service
# firewall-cmd --info-service=nfs-rpc --permanent -v
nfs-rpc
  summary:
  description: NFS and related, statically configured RPC ports
  ports: 4711/tcp 21001/udp 21001/tcp 21002/udp 21002/tcp 21003/udp 21003/tcp 21004/udp 21004/tcp
  protocols:
  source-ports:
  modules:
  destination:

# reload firewalld to make the new service definition available
# firewall-cmd --reload

# the new service definition can now be used to open the ports for example in the internal zone
# firewall-cmd --add-service=nfs-rpc --zone=internal
# zypper in susefirewall2-to-firewalld
# susefirewall2-to-firewalld
INFO: Reading the /etc/sysconfig/SuSEfirewall2 file
INFO: Ensuring all firewall services are in a well-known state.
INFO: This will start/stop/restart firewall services and it's likely
INFO: to cause network disruption.
INFO: If you do not wish for this to happen, please stop the script now!
5...4...3...2...1...Lets do it!
INFO: Stopping firewalld
INFO: Restarting SuSEfirewall2_init
INFO: Restarting SuSEfirewall2
INFO: DIRECT: Adding direct rule="ipv4 -t filter -A INPUT -p udp -m udp --dport 5353 -m pkttype
  --pkt-type multicast -j ACCEPT"
[...]
INFO: Enabling direct rule=ipv6 -t filter -A INPUT -p udp -m udp --dport 546 -j ACCEPT
INFO: Enabling direct rule=ipv6 -t filter -A INPUT -p udp -m udp --dport 5353 -m pkttype
  --pkt-type multicast -j ACCEPT
INFO: Enable logging for denied packets
INFO: ##########################################################
INFO:
INFO: The dry-run has been completed. Please check the above output to ensure
INFO: that everything looks good.
INFO:
INFO: ###########################################################
INFO: Stopping firewalld
INFO: Restarting SuSEfirewall2_init
INFO: Restarting SuSEfirewall2
# susefirewall2-to-firewalld | tee newfirewallrules.txt
# openvpn --genkey secret /etc/openvpn/secret.key
# scp /etc/openvpn/secret.key root@IP_OF_CLIENT:/etc/openvpn/
dev tun
ifconfig IP_OF_SERVER IP_OF_CLIENT
secret secret.key
STARTMODE='manual'
BOOTPROTO='static'
TUNNEL='tun'
TUNNEL_SET_OWNER='nobody'
TUNNEL_SET_GROUP='nobody'
LINK_REQUIRED=no
PRE_UP_SCRIPT='systemd:openvpn@server'
PRE_DOWN_SCRIPT='systemd:openvpn@service'
> sudo wicked ifup tun0
tun0            up
remote DOMAIN_OR_PUBLIC_IP_OF_SERVER
dev tun
ifconfig IP_OF_CLIENT IP_OF_SERVER
secret secret.key
STARTMODE='manual'
BOOTPROTO='static'
TUNNEL='tun'
TUNNEL_SET_OWNER='nobody'
TUNNEL_SET_GROUP='nobody'
LINK_REQUIRED=no
PRE_UP_SCRIPT='systemd:openvpn@client'
PRE_DOWN_SCRIPT='systemd:openvpn@client'
> sudo wicked ifup tun0
tun0            up
ip addr show tun0
ping -I tun0 IP_OF_SERVER
ping -I tun0 IP_OF_CLIENT
# /etc/openvpn/server.conf
port 1194 1
proto udp 2
dev tun0 3

# Security 4

ca    vpn_ca.pem
cert  server_crt.pem
key   server_key.pem

# ns-cert-type server 
remote-cert-tls client 5
dh   server/dh2048.pem 6

server 192.168.1.0 255.255.255.0 7
ifconfig-pool-persist /var/run/openvpn/ipp.txt 8

# Privileges 9
user nobody
group nobody

# Other configuration 10
keepalive 10 120
comp-lzo
persist-key
persist-tun
# status      /var/log/openvpn-status.tun0.log 11
# log-append  /var/log/openvpn-server.log 12
verb 4
openssl dhparam -out /etc/openvpn/dh2048.pem 2048
... Initialization Sequence Completed
# /etc/openvpn/client.conf
client 1
dev tun 2
proto udp 3
remote IP_OR_HOST_NAME 1194 4
resolv-retry infinite
nobind

remote-cert-tls server 5

# Privileges 6
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# Security 7
pkcs12 client1.p12

comp-lzo 8
> sudo zypper in xca
> /sbin/sysctl net.ipv4.conf.all.rp_filter
net.ipv4.conf.all.rp_filter = 2
# the default setting for this is 2 (loose mode)
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
# the default setting for this should already be 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
# the default setting for this should already be 1
net.ipv4.tcp_syncookies = 1
# default is 128
net.ipv4.tcp_max_syn_backlog = 4096
# the default setting for this should already be 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
# the default setting for this should already be 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
# default should already be 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.send_redirects = 0
# default should already be 0
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0
> sudo zypper in -t pattern apparmor
19848 /usr/sbin/cupsd not confined
19887 /usr/sbin/sshd not confined
19947 /usr/lib/postfix/master not confined
1328 /usr/sbin/smbd confined by '/usr/sbin/smbd (enforce)'
/etc/crontab
/etc/cron.d/*
/etc/cron.daily/*
/etc/cron.hourly/*
/etc/cron.monthly/*
/etc/cron.weekly/*
37021 /usr/sbin/sshd2 confined
   by '/usr/sbin/sshd3 (enforce)'
4040 /usr/sbin/smbd confined by '/usr/sbin/smbd (enforce)'
4373 /usr/lib/postfix/master confined by '/usr/lib/postfix/master (enforce)'
4505 /usr/sbin/httpd2-prefork confined by '/usr/sbin/httpd2-prefork (enforce)'
646 /usr/lib/wicked/bin/wickedd-dhcp4 not confined
647 /usr/lib/wicked/bin/wickedd-dhcp6 not confined
5592 /usr/bin/ssh not confined
7146 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (complain)'
/usr/bin/httpd2-prefork {
  # ...
  ^/cgi-bin/localtime.php {
    /etc/localtime                  r,
    /srv/www/cgi-bin/localtime.php  r,
    /usr/lib/locale/**              r,
  }
}
^DEFAULT_URI {
    /usr/sbin/suexec2                  mixr,
    /var/log/apache2/**                rwl,
    @{HOME}/public_html                r,
    @{HOME}/public_html/**             r,
    /srv/www/htdocs                    r,
    /srv/www/htdocs/**                 r,
    /srv/www/icons/*.{gif,jpg,png}     r,
    /srv/www/vhosts                    r,
    /srv/www/vhosts/**                 r,
    /usr/share/apache2/**              r,
    /var/lib/php/sess_*                rwl
}
#include <tunables/global>1

# a comment naming the application to confine
/usr/bin/foo2 {3
   #include <abstractions/base>4

   capability setgid5,
   network inet tcp6,

   link /etc/sysconfig/foo -> /etc/foo.conf,7
   /bin/mount            ux,
   /dev/{,u}8random     r,
   /etc/ld.so.cache      r,
   /etc/foo/*            r,
   /lib/ld-*.so*         mr,
   /lib/lib*.so*         mr,
   /proc/[0-9]**         r,
   /usr/lib/**           mr,
   /tmp/                 r,9
   /tmp/foo.pid          wr,
   /tmp/foo.*            lrw,
   /@{HOME}10/.foo_file   rw,
   /@{HOME}/.foo_lock    kw,
   owner11 /shared/foo/** rw,
   /usr/bin/foobar       Cx,12
   /bin/**               Px -> bin_generic,13

   # a comment about foo's local (children) profile for /usr/bin/foobar.

   profile /usr/bin/foobar14 {
      /bin/bash          rmix,
      /bin/cat           rmix,
      /bin/more          rmix,
      /var/log/foobar*   rwl,
      /etc/foobar        r,
   }

  # foo's hat, bar.
   ^bar15 {
    /lib/ld-*.so*         mr,
    /usr/bin/bar          px,
    /var/spool/*          rwl,
   }
}
/usr/bin/foo {
...
}
profile /usr/bin/foo {
...
}
/usr/bin/foo {
...
}
/parent/profile {
   ...
   profile /local/profile {
      ...
   }
}
change_profile -> /usr/bin/foobar,
include "/etc/apparmor.d/abstractions/foo"
#include "/etc/apparmor.d/abstractions/foo"
include "/etc/apparmor.d/abstractions/foo"   # absolute path
include "abstractions/foo"   # relative path to the directory of current file
include "abstractions/foo"
include "example"
-I /etc/apparmor.d/ -I /usr/share/apparmor/
include <abstractions/foo>
Include /usr/share/apparmor/
Include /etc/apparmor.d/
capability dac_override sys_admin,   # multiple capabilities
capability,                          # grant all capabilities
network [[<domain>1][<type2>][<protocol3>]]
network1,
network inet2,
network inet63,
network inet stream4,
network inet tcp5,
network tcp6,
/usr/bin/foo { ... }
/path/to/profiled/binary flags=(list_of_flags) {
  [...]
}
ln -s /etc/apparmor.d/bin.ping /etc/apparmor.d/force-complain/bin.ping
@{CHROOT_BASE}=/tmp/foo
/sbin/rsyslogd {
...
# chrooted applications
@{CHROOT_BASE}/var/lib/*/dev/log w,
@{CHROOT_BASE}/var/log/** w,
...
}
@{HOMEDIRS}=/home/
@{HOME}=@{HOMEDIRS}/*/ /root/
[...]
@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/
/{usr/,}bin/foo { ... }
/bin/foo { ... }

/bin/f*  { ... }

/bin/**  { ... }
:childNameSpace://
:childNameSpace://apache
/path/to/executable px -> :childNameSpace://apache
/** { ... }
profile default /** { ... }
/usr/lib64/firefox*/firefox-*bin { ... }
profile firefox /usr/lib64/firefox*/firefox-*bin { ... }
alias /home/ -> /usr/home/
/home/username/** r,
/usr/home/username/** r,
alias /home/ -> /usr/home/
alias /home/ -> /mnt/home/
/srv/www/htdocs/index.html rl,
link /srv/www/htdocs/index.html -> /var/www/index.html
/var/www/index.html l,
link subset /var/www/index.html -> /**,
allow file /example r,
allow /example r,
allow network,
file /example/rule r,
/example/rule r,
file,
/** rwmlk,
/path rw,            # old style
rw /path,            # leading permission
file rw /path,       # with explicit 'file' keyword
allow file rw /path, # optional 'allow' keyword added
owner /home/*/** rw
/foo r,
owner /foo rw,  # or w,
owner /foo rw,
other /foo r,
deny /home/*/.ssh/** w,
owner /home/*/** rw,
mount options=ro /dev/foo -E /mnt/,
# mount -o ro /dev/foo /mnt
# mount -o ro,atime /dev/foo /mnt
# mount -o rw /dev/foo /mnt
mount options in (ro,atime) /dev/foo -> /mnt/,
# mount -o ro /dev/foo /mnt
# mount -o ro,atime /dev/foo /mnt
# mount -o atime /dev/foo /mnt
# mount -o ro,sync /dev/foo /mnt
# mount -o ro,atime,sync /dev/foo /mnt
# mount -o rw /dev/foo /mnt
# mount -o rw,noatime /dev/foo /mnt
# mount /dev/foo /mnt
mount options=ro options=atime
# mount -o ro /dev/foo /mnt
# mount -o atime /dev/foo /mnt
# mount -o ro,atime /dev/foo /mnt
mount options=ro,
mount options=atime,
mount options=(ro,atime),
mount options in (ro,atime),
mount options=(ro, atime) options in (nodev, user) /dev/foo -> /mnt/,
# mount -o ro,atime /dev/foo /mnt
# mount -o nodev /dev/foo /mnt
# mount -o user /dev/foo /mnt
# mount -o nodev,user /dev/foo /mnt
pivot_root [oldroot=OLD_ROOT] NEW_ROOT
# Allow any pivot
pivot_root,

# Allow pivoting to any new root directory and putting the old root
# directory at /mnt/root/old/
pivot_root oldroot=/mnt/root/old/,

# Allow pivoting the root directory to /mnt/root/
pivot_root /mnt/root/,

# Allow pivoting to /mnt/root/ and putting the old root directory at
# /mnt/root/old/
pivot_root oldroot=/mnt/root/old/ /mnt/root/,

# Allow pivoting to /mnt/root/, putting the old root directory at
# /mnt/root/old/ and transition to the /mnt/root/sbin/init profile
pivot_root oldroot=/mnt/root/old/ /mnt/root/ -> /mnt/root/sbin/init,
# Allow all PTrace access
ptrace,

# Explicitly allow all PTrace access,
ptrace (read, readby, trace, tracedby),

# Explicitly deny use of ptrace(2)
deny ptrace (trace),

# Allow unconfined processes (eg, a debugger) to ptrace us
ptrace (readby, tracedby) peer=unconfined,

# Allow ptrace of a process running under the /usr/bin/foo profile
ptrace (trace) peer=/usr/bin/foo,
# Allow all signal access
signal,

# Explicitly deny sending the HUP and INT signals
deny signal (send) set=(hup, int),

# Allow unconfined processes to send us signals
signal (receive) peer=unconfined,

# Allow sending of signals to a process running under the /usr/bin/foo
# profile
signal (send) peer=/usr/bin/foo,

# Allow checking for PID existence
signal (receive, send) set=("exists"),

# Allow us to signal ourselves using the built-in @{profile_name} variable
signal peer=@{profile_name},

# Allow two real-time signals
signal set=(rtmin+0 rtmin+32),
/usr/bin/foo
{
  /bin/** px -> shared_profile,
  ...
  /usr/*bash cx -> local_profile,
  ...
  profile local_profile
  {
    ...
  }
}
/path Cix -> profile_name,
Cix /path -> profile_name,
/path PUx -> profile_name,
PUx /path -> profile_name,
/example_rule Px,
safe /example_rule px,
safe /example_rule Px,
safe px /example_rule,
safe Px /example_rule,
/example_rule px,
unsafe /example_rule px,
unsafe /example_rule Px,
unsafe px /example_rule,
unsafe Px /example_rule,
[audit] [deny] [owner] [safe|unsafe] file_rule
set rlimit RESOURCE <= value,
rlimit data <= 100M,
audit /etc/foo/*        rw,
audit /etc/foo/*  w,
/etc/foo/*        r,
audit owner /home/*/.ssh/**       rw,
audit other /home/*/.ssh/**       r,
> sudo vi /etc/apparmor.d/usr.sbin.httpd2-prefork
> sudo aa-remove-unknown
> sudo aa-remove-unknown -n
> sudo apparmor_parser -R /etc/apparmor.d/PROFILE
> sudo rm /etc/apparmor.d/PROFILE
    > sudo rm /var/lib/apparmor/cache/PROFILE
> sudo aa-complain /etc/apparmor.d/*
> sudo aa-logprof [ -d /path/to/profiles ] [ -f /path/to/logfile ]
> sudo aa-autodep [ -d /PATH/TO/PROFILES ] [PROGRAM1 PROGRAM2...]
> sudo aa-complain [PROGRAM1 PROGRAM2 ...]
> sudo aa-complain /sbin/PROGRAM1
> sudo aa-complain /path/to/profiles/PROGRAM1
> sudo aa-complain /etc/apparmor.d/sbin.PROGRAM1
> sudo aa-enforce [PROGRAM1 PROGRAM2 ...]
> sudo aa-enforce /sbin/PROGRAM1
> sudo aa-enforce -d /path/to/profiles/     program1
> sudo aa-enforce /etc/apparmor.d/sbin.PROGRAM1
> sudo aa-genprof [ -d /path/to/profiles ]  PROGRAM
type=APPARMOR_ALLOWED msg=audit(1189682639.184:20816): \
apparmor="DENIED" operation="file_mmap" parent=2692 \
profile="/usr/sbin/httpd2-prefork//HANDLING_UNTRUSTED_INPUT" \
name="/var/log/apache2/access_log-20140116" pid=28730 comm="httpd2-prefork" \
requested_mask="::r" denied_mask="::r" fsuid=30 ouid=0
Sep 13 13:20:30 K23 kernel: audit(1189682430.672:20810): \
apparmor="DENIED" operation="file_mmap" parent=2692 \
profile="/usr/sbin/httpd2-prefork//HANDLING_UNTRUSTED_INPUT" \
name="/var/log/apache2/access_log-20140116" pid=28730 comm="httpd2-prefork" \
requested_mask="::r" denied_mask="::r" fsuid=30 ouid=0
audit(1189682430.672:20810): apparmor="DENIED" \
operation="file_mmap" parent=2692 \
profile="/usr/sbin/httpd2-prefork//HANDLING_UNTRUSTED_INPUT" \
name="/var/log/apache2/access_log-20140116" pid=28730 comm="httpd2-prefork" \
requested_mask="::r" denied_mask="::r" fsuid=30 ouid=0
Sep 13 17:48:52 figwit root: GenProf: e2ff78636296f16d0b5301209a04430d
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.

Profile:  /usr/sbin/cupsd
Program:  cupsd
Execute:  /usr/lib/cups/daemon/cups-lpd
Severity: unknown

(I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny / Abo(r)t / (F)inish
Profile:  /usr/sbin/httpd2-prefork
Path:     /var/run/nscd/dbSz9CTr
Mode:     r
Severity: 3

  1 - /var/run/nscd/dbSz9CTr
 [2 - /var/run/nscd/*]

(A)llow / [(D)eny] / (G)lob / Glob w/(E)xt / (N)ew / Abo(r)t / (F)inish / (O)pts
Adding /var/run/nscd/* r to profile.

Profile:  /usr/sbin/httpd2-prefork
Path:     /proc/11769/attr/current
Mode:     w
Severity: 9

 [1 - #include <abstractions/apache2-common>]
  2 - /proc/11769/attr/current
  3 - /proc/*/attr/current

(A)llow / [(D)eny] / (G)lob / Glob w/(E)xt / (N)ew / Abo(r)t / (F)inish / (O)pts
Adding #include <abstractions/apache2-common> to profile.
Profile: /usr/bin/opera

 [1 - Inactive local profile for /usr/bin/opera]

[(V)iew Profile] / (U)se Profile / (C)reate New Profile / Abo(r)t / (F)inish
# aa-logprof -m "17:04:21"
# aa-logprof -m e2ff78636296f16d0b5301209a04430d
Profile:  /usr/sbin/httpd2-prefork
Path:     /etc/group
New Mode: r

[1 - #include <abstractions/nameservice>]
 2 - /etc/group
[(A)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Profile:  /usr/sbin/vsftpd
Path:     /y2k.jpg

New Mode: r

[1 - /y2k.jpg]

(A)llow / [(D)eny] / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
/usr/bin/nail -> /usr/bin/less
(I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny
> sudo aa-notify -p -u USERNAME --display DISPLAY_NUMBER
# vim:ft=apparmor
/foo//bar { }
profile /foo//bar { }
^/foo//bar { }
hat /foo//bar { } # this syntax is not highlighted in vim
> a2enmod apparmor && sudo systemctl reload apache2
<Location /foo/>
  AAHatName MY_HAT_NAME
</Location>
<Directory "/srv/www/www.example.org/docs">
  # Note lack of trailing slash
  AAHatName example.org
</Directory>
zypper in apache2 apache2-mod_apparmor apache2-mod_php5 php5 php5-mysql
> a2enmod apparmor php5
> sudo systemctl restart apache2
> sudo systemctl restart mariadb
# sudo aa-complain usr.sbin.httpd2-prefork
> sudo vim /etc/apache2/conf.d/apparmor.conf
<Directory /srv/www/htdocs/adminer>
  AAHatName adminer
</Directory>
> sudo systemctl restart apache2
#include <tunables/global>

/usr/sbin/httpd2-prefork {
  #include <abstractions/apache2-common>
  #include <abstractions/base>
  #include <abstractions/php5>

  capability kill,
  capability setgid,
  capability setuid,

  /etc/apache2/** r,
  /run/httpd.pid rw,
  /usr/lib{,32,64}/apache2*/** mr,
  /var/log/apache2/** rw,

  ^DEFAULT_URI {
    #include <abstractions/apache2-common>
    /var/log/apache2/** rw,
  }

  ^HANDLING_UNTRUSTED_INPUT {
    #include <abstractions/apache2-common>
    /var/log/apache2/** w,
  }
}
^adminer flags=(complain) {
}
> sudo systemctl reload apparmor apache2
> sudo aa-status
apparmor module is loaded.
39 profiles are loaded.
37 profiles are in enforce mode.
[...]
   /usr/sbin/httpd2-prefork
   /usr/sbin/httpd2-prefork//DEFAULT_URI
   /usr/sbin/httpd2-prefork//HANDLING_UNTRUSTED_INPUT
[...]
2 profiles are in complain mode.
   /usr/bin/getopt
   /usr/sbin/httpd2-prefork//adminer
[...]
> sudo aa-logprof
Reading log entries from /var/log/audit/audit.log.
Updating AppArmor profiles in /etc/apparmor.d.
Complain-mode changes:

Profile:  /usr/sbin/httpd2-prefork^adminer
Path:     /dev/urandom
Mode:     r
Severity: 3

  1 - #include <abstractions/apache2-common>
[...]
 [8 - /dev/urandom]

[(A)llow] / (D)eny / (G)lob / Glob w/(E)xt / (N)ew / Abo(r)t / (F)inish / (O)pts
Profile:  /usr/sbin/httpd2-prefork^adminer
 1 - #include <abstractions/php5>
 [2 - /var/lib/php5/sess_3jdmii9cacj1e3jnahbtopajl7p064ai242]
The following local profiles were changed. Would you like to save them?
 [1 - /usr/sbin/httpd2-prefork]

 (S)ave Changes / [(V)iew Changes] / Abo(r)t
> sudo aa-enforce usr.sbin.httpd2-prefork
> sudo aa-status
apparmor module is loaded.
39 profiles are loaded.
38 profiles are in enforce mode.
[...]
   /usr/sbin/httpd2-prefork
   /usr/sbin/httpd2-prefork//DEFAULT_URI
   /usr/sbin/httpd2-prefork//HANDLING_UNTRUSTED_INPUT
   /usr/sbin/httpd2-prefork//adminer
[...]
> sudo tar zclpf profiles.tgz /etc/apparmor.d
type=AVC msg=audit(1389862802.727:13939): apparmor="DENIED" \
operation="file_lock" parent=2692 profile="/usr/bin/opera" \
name="/home/tux/.qt/.qtrc.lock" pid=28730 comm="httpd2-prefork" \
requested_mask="::k" denied_mask="::k" fsuid=30 ouid=0
type=AVC msg=audit(1389864332.233:13947): apparmor="DENIED" \
operation="socket_create" family="inet" parent=29985 profile="/bin/ping" \
sock_type="raw" pid=30251 comm="ping"
/proc/*/fd/**  rw,
capability SYS_PTRACE,
/proc/*/fd/**  rw,
/proc/net/*  r,
/proc/net/*  r,
/proc/net/*/  r,
/proc/net/**  r,
/proc/net/**/  r,
/proc/net/**[^/]  r,
/proc/net/foo**  r,
/proc/net/**foo  r,
/proc/net/**foo/  r,
/proc/net/foo?  r,
/proc/net/foo?/  r,
/proc/net/foo?/bar  r,
> sudo aa-complain /path/to/application
> sudo aa-logprof /path/to/application
> sudo aa-enforce /path/to/application
#  systemctl start apparmor.service
Loading AppArmor profiles AppArmor parser error in /etc/apparmor.d/usr.sbin.squid \
 at line 410: syntax error, unexpected TOK_ID, expecting TOK_MODE
Profile /etc/apparmor.d/usr.sbin.squid failed to load
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = audit
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
transport = TCP
distribute_network = no
q_depth = 1200
overflow_action = SYSLOG
max_restarts = 10
plugin_dir = /etc/audit/plugins.d
end_of_event_timeout = 2
enabled 1
failure 1
pid 790
rate_limit 0
backlog_limit 64
lost 0
backlog 0
backlog_wait_time 15000
loginuid_immutable 0 unlocked
-b 10001
-f 12
-r 103
-e 14
-w /etc/shadow1
-w /etc -p rx2
-w /etc/passwd -k fk_passwd -p rwxa3
-a exit,always -S mkdir1
-a exit,always -S access -F a1=42
-a exit,always -S ipc -F a0=23
-a exit,always -S open -F success!=04
-a task,always -F auid=05
-a task,always -F uid=0 -F auid=501 -F gid=wheel6
-D1
-d exit,always -S mkdir2
-W /etc3
exit,always watch=/etc perm=rx
exit,always watch=/etc/passwd perm=rwxa key=fk_passwd
exit,always watch=/etc/shadow perm=rwxa
exit,always syscall=mkdir
exit,always a1=4 (0x4) syscall=access
exit,always a0=2 (0x2) syscall=ipc
exit,always success!=0 syscall=open
> ausyscall --dump
Using x86_64 syscall table:
0       read
1       write
2       open
3       close
4       stat
5       fstat
[...]
type=SYSCALL msg=audit(1234874638.599:5207): arch=c000003e syscall=2
success=yes exit=4 a0=62fb60 a1=0 a2=31 a3=0 items=1 ppid=25400 pid
=25616 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts1 ses=1164 comm="less" exe="/usr/bin/less" key="doc_log"
type=CWD msg=audit(1234874638.599:5207):  cwd="/root"
type=PATH msg=audit(1234874638.599:5207): item=0 name="/var/log/audit/
audit.log" inode=1219041 dev=08:06 mode=0100644 ouid=0 ogid=0 rdev=00:00
a0=62fb60 a1=8000 a2=31 a3=0
type=USER_AUTH msg=audit(1234877011.791:7731): user pid=26127 uid=0 1
auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=ssh res=success)'
type=USER_ACCT msg=audit(1234877011.795:7732): user pid=26127 uid=0 2
auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=ssh res=success)'
type=CRED_ACQ msg=audit(1234877011.799:7733): user pid=26125 uid=0 3
auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0 res=success)'
type=LOGIN msg=audit(1234877011.799:7734): login pid=26125 uid=0
old auid=4294967295 new auid=0 old ses=4294967295 new ses=1172
type=USER_START msg=audit(1234877011.799:7735): user pid=26125 uid=0 4
auid=0 ses=1172 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0 res=success)'
type=USER_LOGIN msg=audit(1234877011.823:7736): user pid=26128 uid=0 5
auid=0 ses=1172 msg='uid=0: exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0 res=success)'
type=CRED_REFR msg=audit(1234877011.828:7737): user pid=26128 uid=0 6
auid=0 ses=1172 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0 res=success)'
> sudo aureport -if myfile

Summary Report
======================
Range of time in logs: 03/02/09 14:13:38.225 - 17/02/09 14:52:27.971
Selected time for report: 03/02/09 14:13:38 - 17/02/09 14:52:27.971
Number of changes in configuration: 13
Number of changes to accounts, groups, or roles: 0
Number of logins: 6
Number of failed logins: 13
Number of authentications: 7
Number of failed authentications: 573
Number of users: 1
Number of terminals: 9
Number of host names: 4
Number of executables: 17
Number of files: 279
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 994
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 2
Number of process IDs: 1211
Number of events: 5320
> sudo aureport -l -ts 14:00 -te 15:00 -if myfile

Login Report
============================================
# date time auid host term exe success event
============================================
1. 17/02/09 14:21:09 root: 192.168.2.100 sshd /usr/sbin/sshd no 7718
2. 17/02/09 14:21:15 0 jupiter /dev/pts/3 /usr/sbin/sshd yes 7724
> sudo aureport --failed

Failed Summary Report
======================
Range of time in logs: 03/02/09 14:13:38.225 - 17/02/09 14:57:35.183
Selected time for report: 03/02/09 14:13:38 - 17/02/09 14:57:35.183
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 13
Number of authentications: 0
Number of failed authentications: 574
Number of users: 1
Number of terminals: 5
Number of host names: 4
Number of executables: 11
Number of files: 77
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 994
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 2
Number of process IDs: 708
Number of events: 1583
> sudo aureport --success

Success Summary Report
======================
Range of time in logs: 03/02/09 14:13:38.225 - 17/02/09 15:00:01.535
Selected time for report: 03/02/09 14:13:38 - 17/02/09 15:00:01.535
Number of changes in configuration: 13
Number of changes to accounts, groups, or roles: 0
Number of logins: 6
Number of failed logins: 0
Number of authentications: 7
Number of failed authentications: 0
Number of users: 1
Number of terminals: 7
Number of host names: 3
Number of executables: 16
Number of files: 215
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 0
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 2
Number of process IDs: 558
Number of events: 3739
> sudo aureport -u -i --summary

User Summary Report
===========================
total  auid
===========================
5640  root
13  tux
3  wilber
> sudo aureport -e -ts 14:00 -te 14:21

Event Report
===================================
# date time event type auid success
===================================
1. 17/02/09 14:20:27 7462 DAEMON_START 0 yes
2. 17/02/09 14:20:27 7715 CONFIG_CHANGE 0 yes
3. 17/02/09 14:20:57 7716 USER_END 0 yes
4. 17/02/09 14:20:57 7717 CRED_DISP 0 yes
5. 17/02/09 14:21:09 7718 USER_LOGIN -1 no
6. 17/02/09 14:21:15 7719 USER_AUTH -1 yes
7. 17/02/09 14:21:15 7720 USER_ACCT -1 yes
8. 17/02/09 14:21:15 7721 CRED_ACQ -1 yes
9. 17/02/09 14:21:15 7722 LOGIN 0 yes
10. 17/02/09 14:21:15 7723 USER_START 0 yes
11. 17/02/09 14:21:15 7724 USER_LOGIN 0 yes
12. 17/02/09 14:21:15 7725 CRED_REFR 0 yes
aureport -p

Process ID Report
======================================
# date time pid exe syscall auid event
======================================
1. 13/02/09 15:30:01 32742 /usr/sbin/cron 0 0 35
2. 13/02/09 15:30:01 32742 /usr/sbin/cron 0 0 36
3. 13/02/09 15:38:34 32734 /usr/lib/gdm/gdm-session-worker 0 -1 37
> sudo aureport -s

Syscall Report
=======================================
# date time syscall pid comm auid event
=======================================
1. 16/02/09 17:45:01 2 20343 cron -1 2279
2. 16/02/09 17:45:02 83 20350 mktemp 0 2284
3. 16/02/09 17:45:02 83 20351 mkdir 0 2285
aureport -x

Executable Report
====================================
# date time exe term host auid event
====================================
1. 13/02/09 15:08:26 /usr/sbin/sshd sshd 192.168.2.100 -1 12
2. 13/02/09 15:08:28 /usr/lib/gdm/gdm-session-worker :0 ? -1 13
3. 13/02/09 15:08:28 /usr/sbin/sshd ssh 192.168.2.100 -1 14
> sudo aureport -f

File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 16/02/09 17:45:01 /etc/shadow 2 yes /usr/sbin/cron -1 2279
2. 16/02/09 17:45:02 /tmp/ 83 yes /bin/mktemp 0 2284
3. 16/02/09 17:45:02 /var 83 no /bin/mkdir 0 2285
aureport -u

User ID Report
====================================
# date time auid term host exe event
====================================
1. 13/02/09 15:08:26 -1 sshd 192.168.2.100 /usr/sbin/sshd 12
2. 13/02/09 15:08:28 -1 :0 ? /usr/lib/gdm/gdm-session-worker 13
3. 14/02/09 08:25:39 -1 ssh 192.168.2.101 /usr/sbin/sshd 14
> sudo aureport -l -i

Login Report
============================================
# date time auid host term exe success event
============================================
1. 13/02/09 15:08:31 tux: 192.168.2.100 sshd /usr/sbin/sshd no 19
2. 16/02/09 12:39:05 root: 192.168.2.101 sshd /usr/sbin/sshd no 2108
3. 17/02/09 15:29:07 geeko: ? tty3 /bin/login yes 7809
aureport -t

Log Time Range Report
=====================
/var/log/audit/audit.log: 03/02/09 14:13:38.225 - 17/02/09 15:30:01.636
> sudo aureport -ts 02/16/09 8:00 -te 02/16/09 18:00 -l

Login Report
============================================
# date time auid host term exe success event
============================================
1. 16/02/09 12:39:05 root: 192.168.2.100 sshd /usr/sbin/sshd no 2108
2. 16/02/09 12:39:12 0 192.168.2.100 /dev/pts/1 /usr/sbin/sshd yes 2114
3. 16/02/09 13:09:28 root: 192.168.2.100 sshd /usr/sbin/sshd no 2131
4. 16/02/09 13:09:32 root: 192.168.2.100 sshd /usr/sbin/sshd no 2133
5. 16/02/09 13:09:37 0 192.168.2.100 /dev/pts/2 /usr/sbin/sshd yes 2139
> sudo ausearch - option -if myfile
> sudo ausearch -a 5207
----
time->Tue Feb 17 13:43:58 2009
type=PATH msg=audit(1234874638.599:5207): item=0 name="/var/log/audit/audit.log" inode=1219041 dev=08:06 mode=0100644 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1234874638.599:5207):  cwd="/root"
type=SYSCALL msg=audit(1234874638.599:5207): arch=c000003e syscall=2 success=yes exit=4 a0=62fb60 a1=0 a2=31 a3=0 items=1 ppid=25400 pid=25616 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1164 comm="less" exe="/usr/bin/less" key="doc_log"
> sudo auditctl -D

No rules

autrace /usr/bin/less

Waiting to execute: /usr/bin/less
Cleaning up...
No rules
Trace complete. You can locate the records with 'ausearch -i -p 7642'
> sudo aureport -s -i

Syscall Report
=======================================
# date time syscall pid comm auid event
=======================================
1. 16/02/09 17:45:01 open 20343 cron unset 2279
2. 16/02/09 17:45:02 mkdir 20350 mktemp root 2284
3. 16/02/09 17:45:02 mkdir 20351 mkdir root 2285
...
LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $6" "$4 }' | sort | uniq | mkgraph
> sudo aureport -e -i --summary

Event Summary Report
======================
total  type
======================
2434  SYSCALL
816  USER_START
816  USER_ACCT
814  CRED_ACQ
810  LOGIN
806  CRED_DISP
779  USER_END
99  CONFIG_CHANGE
52  USER_LOGIN
> sudo aureport -e -i --summary  | mkbar events
  q_depth = 250
  overflow_action = SYSLOG
  priority_boost = 4
  name_format = HOSTNAME
  #name = mydomain
  active = no
  direction = out
  path = /sbin/audisp-syslog
  type = builtin
  args = LOG_INFO
  format = string
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file = 6
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
##tcp_listen_port =
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
cp_client_max_idle = 0
log_file = PATH_TO_SEPARATE_PARTITION/audit.log
log_format = RAW
priority_boost = 4
flush = SYNC                       ### or DATA
freq = 20
num_logs = 4
dispatcher = /sbin/audispd
disp_qos = lossy
max_log_file = 5
max_log_file_action = KEEP_LOGS
space_left = 75
space_left_action = EMAIL
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SINGLE   ### or HALT
disk_full_action = SUSPEND         ### or HALT
disk_error_action = SUSPEND        ### or HALT
> sudo systemctl enable auditd
# basic audit system parameters
-D
-b 8192
-f 1
-e 1

# some file and directory watches with keys
-w /var/log/audit/ -k LOG_audit
-w /etc/audit/auditd.conf -k CFG_audit_conf -p rxwa
-w /etc/audit/audit.rules -k CFG_audit_rules -p rxwa

-w /etc/passwd -k CFG_passwd -p rwxa
-w /etc/sysconfig/ -k CFG_sysconfig

# an example system call rule
-a entry,always -S umask

### add your own rules
> sudo aureport

Summary Report
======================
Range of time in logs: 03/02/09 14:13:38.225 - 17/02/09 16:30:10.352
Selected time for report: 03/02/09 14:13:38 - 17/02/09 16:30:10.352
Number of changes in configuration: 24
Number of changes to accounts, groups, or roles: 0
Number of logins: 9
Number of failed logins: 15
Number of authentications: 19
Number of failed authentications: 578
Number of users: 3
Number of terminals: 15
Number of host names: 4
Number of executables: 20
Number of files: 279
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 994
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 2
Number of process IDs: 1238
Number of events: 5435
> sudo aureport --failed

Failed Summary Report
======================
Range of time in logs: 03/02/09 14:13:38.225 - 17/02/09 16:30:10.352
Selected time for report: 03/02/09 14:13:38 - 17/02/09 16:30:10.352
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 15
Number of authentications: 0
Number of failed authentications: 578
Number of users: 1
Number of terminals: 7
Number of host names: 4
Number of executables: 12
Number of files: 77
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 994
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 0
Number of keys: 2
Number of process IDs: 713
Number of events: 1589
> sudo aureport -f -i --failed --summary

Failed File Summary Report
===========================
total  file
===========================
80  /var
80  spool
80  cron
80  lastrun
46  /usr/lib/locale/en_GB.UTF-8/LC_CTYPE
45  /usr/lib/locale/locale-archive
38  /usr/lib/locale/en_GB.UTF-8/LC_IDENTIFICATION
38  /usr/lib/locale/en_GB.UTF-8/LC_MEASUREMENT
38  /usr/lib/locale/en_GB.UTF-8/LC_TELEPHONE
38  /usr/lib/locale/en_GB.UTF-8/LC_ADDRESS
38  /usr/lib/locale/en_GB.UTF-8/LC_NAME
38  /usr/lib/locale/en_GB.UTF-8/LC_PAPER
38  /usr/lib/locale/en_GB.UTF-8/LC_MESSAGES
38  /usr/lib/locale/en_GB.UTF-8/LC_MONETARY
38  /usr/lib/locale/en_GB.UTF-8/LC_COLLATE
38  /usr/lib/locale/en_GB.UTF-8/LC_TIME
38  /usr/lib/locale/en_GB.UTF-8/LC_NUMERIC
8  /etc/magic.mgc
...
> sudo aureport -f -i --failed --summary |grep -e "/etc/audit/auditd.conf" -e "/etc/pam.d/" -e "/etc/sysconfig"

1  /etc/sysconfig/displaymanager
> sudo aureport -f -i --failed |grep -e "/etc/audit/auditd.conf" -e "/etc/pam.d/" -e "/etc/sysconfig"

993. 17/02/09 16:47:34 /etc/sysconfig/displaymanager readlink no /bin/vim-normal root 7887
994. 17/02/09 16:48:23 /etc/sysconfig/displaymanager getxattr no /bin/vim-normal root 7889
> sudo ausearch -a 7887 -i
----
time->Tue Feb 17 16:48:23 2009
type=PATH msg=audit(1234885703.090:7889): item=0 name="/etc/sysconfig/displaymanager" inode=369282 dev=08:06 mode=0100644 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1234885703.090:7889):  cwd="/root"
type=SYSCALL msg=audit(1234885703.090:7889): arch=c000003e syscall=191 success=no exit=-61 a0=7e1e20 a1=7f90e4cf9187 a2=7fffed5b57d0 a3=84 items=1 ppid=25548 pid=23045 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=1166 comm="vim" exe="/bin/vim-normal" key=(null)
> sudo wget http://people.redhat.com/sgrubb/audit/visualize/mkbar -O ~/bin/mkbar
> sudo wget http://people.redhat.com/sgrubb/audit/visualize/mkgraph -O ~/bin/mkgraph
> sudo chmod 744 ~/bin/mk{bar,graph}
> sudo aureport -e -i --summary | mkbar events
> sudo aureport -f -i --summary | mkbar files
> sudo aureport -l -i --summary | mkbar login
> sudo aureport -u -i --summary | mkbar users
> sudo aureport -s -i --summary | mkbar syscalls
> sudo LC_ALL=C aureport -u -i | awk '/^[0-9]/ { print $4" "$7 }' | sort | uniq | mkgraph users_vs_exec
> sudo LC_ALL=C aureport -f -i | awk '/^[0-9]/ { print $8" "$4 }' | sort | uniq | mkgraph users_vs_files
> sudo LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $4" "$6 }' | sort | uniq | mkgraph syscall_vs_com
> sudo LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $5" "$4 }' | sort | uniq | mkgraph | syscall_vs_file
-D1
-b 81922
-f 23
-w /var/log/audit/ 1
-w /var/log/audit/audit.log

-w /var/log/audit/audit_log.1
-w /var/log/audit/audit_log.2
-w /var/log/audit/audit_log.3
-w /var/log/audit/audit_log.4

-w /etc/audit/auditd.conf -p wa2
-w /etc/audit/audit.rules -p wa
-w /etc/libaudit.conf -p wa
-a entry,always -S chmod -S fchmod -S chown -S chown32 -S fchown -S fchown32 -S lchown -S lchown321

-a entry,always -S creat -S open -S truncate -S truncate64 -S ftruncate -S ftruncate642

-a entry,always -S mkdir -S rmdir3

-a entry,always -S unlink -S rename -S link -S symlink4

-a entry,always -S setxattr5
-a entry,always -S lsetxattr
-a entry,always -S fsetxattr
-a entry,always -S removexattr
-a entry,always -S lremovexattr
-a entry,always -S fremovexattr

-a entry,always -S mknod6

-a entry,always -S mount -S umount -S umount27
1
-w /var/spool/atspool
-w /etc/at.allow
-w /etc/at.deny

-w /etc/cron.allow -p wa
-w /etc/cron.deny -p wa
-w /etc/cron.d/ -p wa
-w /etc/cron.daily/ -p wa
-w /etc/cron.hourly/ -p wa
-w /etc/cron.monthly/ -p wa
-w /etc/cron.weekly/ -p wa
-w /etc/crontab -p wa
-w /var/spool/cron/root

2
-w /etc/group -p wa
-w /etc/passwd -p wa
-w /etc/shadow

-w /etc/login.defs -p wa
-w /etc/securetty
-w /var/log/lastlog

3
-w /etc/hosts -p wa
-w /etc/sysconfig/
w /etc/init.d/
w /etc/ld.so.conf -p wa
w /etc/localtime -p wa
w /etc/sysctl.conf -p wa
w /etc/modprobe.d/
w /etc/modprobe.conf.local -p wa
w /etc/modprobe.conf -p wa
4
w /etc/pam.d/
5
-w /etc/aliases -p wa
-w /etc/postfix/ -p wa

6
-w /etc/ssh/sshd_config

-w /etc/stunnel/stunnel.conf
-w /etc/stunnel/stunnel.pem

-w /etc/vsftpd.ftpusers
-w /etc/vsftpd.conf

7
-a exit,always -S sethostname
-w /etc/issue -p wa
-w /etc/issue.net -p wa
1
-a entry,always -S clone -S fork -S vfork

2
-a entry,always -S umask

3
-a entry,always -S adjtimex -S settimeofday
-a entry,always -S access -F a1=41
-a entry,always -S access -F a1=62
-a entry,always -S access -F a1=73
-a entry,always -S socketcall -F a0=1 -F a1=101
## Use this line on x86_64, ia64 instead
#-a entry,always -S socket -F a0=10

-a entry,always -S socketcall -F a0=52
## Use this line on x86_64, ia64 instead
#-a entry, always -S accept
1
## msgctl
-a entry,always -S ipc -F a0=14
## msgget
-a entry,always -S ipc -F a0=13
## Use these lines on x86_64, ia64 instead
#-a entry,always -S msgctl
#-a entry,always -S msgget

2
## semctl
-a entry,always -S ipc -F a0=3
## semget
-a entry,always -S ipc -F a0=2
## semop
-a entry,always -S ipc -F a0=1
## semtimedop
-a entry,always -S ipc -F a0=4
## Use these lines on x86_64, ia64 instead
#-a entry,always -S semctl
#-a entry,always -S semget
#-a entry,always -S semop
#-a entry,always -S semtimedop

3
## shmctl
-a entry,always -S ipc -F a0=24
## shmget
-a entry,always -S ipc -F a0=23
## Use these lines on x86_64, ia64 instead
#-a entry,always -S shmctl
#-a entry,always -S shmget
-w /etc/audit/audit.rules -p wa
-w /etc/audit/audit.rules -p wa -k CFG_audit.rules
ausearch -k CFG_audit.rules
----
time->Thu Feb 19 09:09:54 2009
type=PATH msg=audit(1235030994.032:8649): item=3 name="audit.rules~" inode=370603 dev=08:06 mode=0100640 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1235030994.032:8649): item=2 name="audit.rules" inode=370603 dev=08:06 mode=0100640 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1235030994.032:8649): item=1  name="/etc/audit" inode=368599 dev=08:06 mode=040750 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1235030994.032:8649): item=0  name="/etc/audit" inode=368599 dev=08:06 mode=040750 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1235030994.032:8649):  cwd="/etc/audit"
type=SYSCALL msg=audit(1235030994.032:8649): arch=c000003e syscall=82 success=yes exit=0 a0=7deeb0 a1=883b30 a2=2 a3=ffffffffffffffff items=4 ppid=25400 pid=32619 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1164 comm="vim" exe="/bin/vim-normal" key="CFG_audit.rules"
Copyright (c) YEAR YOUR NAME.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
A copy of the license is included in the section entitled “GNU
Free Documentation License”.
with the Invariant Sections being LIST THEIR TITLES, with the
Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST.

1	为 PAM 1.0 声明此配置文件的版本。这只是一项惯例，但将来可以使用它来检查版本。
2	检查 `/etc/nologin` 是否存在。如果不存在，则除 `root` 以外的任何用户都无法登录。
3	引用四种模块类型的配置文件：`common-auth`、`common-account`、`common-password` 和 `common-session`。这 4 个文件包含每种模块类型的默认配置。
4	设置已经过身份验证的进程的登录 UID 进程属性。
5	显示有关用户上次登录的信息。

对象类	含义	示例项	必需属性
`domain`	域的名称组成部分	示例	displayName
`organizationalUnit`	组织单元	`documentationdept`	`ou`
`nsPerson`	内部网或互联网中与个人相关的数据	`Tux Linux`	`cn`

1	属性的名称、其唯一对象标识符（OID，数字格式）和属性的缩写。
2	通过 `DESC` 对该属性提供的简要说明。在此还可以指出定义所基于的相应 RFC。
3	可保存在该属性中的数据类型。在本例中，它是一个不区分大小写的目录字符串。
4	纲要元素（例如项目的名称）的来源。
5	对象类 `nsPerson` 的定义以 OID 以及该对象类的名称开头（与属性的定义类似）。
6	对象类的简要说明。
7	`SUP top` 项指示此对象类不从属于另一个对象类。
8	`MUST` 列出必须对 `nsPerson` 类型的对象使用的所有属性类型。
9	`MAY` 列出可选择对此对象类使用的所有属性类型。

1	此行为必需的指令，指示这是版本 2 的 INF 设置文件。
2	为 ldap 用户 `cn=Directory Manager` 创建强口令 `root_password`。此用户用于连接（绑定）到目录。
3	在 `/etc/dirsrv/slapd-LDAP1` 中创建自我签名的服务器证书。
4	在新实例中填充示例用户和组项。

功能	OpenLDAP	389 Directory Server	兼容
双向复制	SyncREPL	特定于 389 DS 的系统	否
MemberOf	叠加组件	插件	是，仅限简单配置
外部身份验证	代理	-	否
Active Directory 同步	-	Winsync 插件	否
内置纲要	OLDAP 纲要	389 Directory Server 纲要	是，受迁移工具支持
自定义纲要	OLDAP 纲要	389 Directory Server 纲要	是，受迁移工具支持
数据库导入	LDIF	LDIF	是，受迁移工具支持
口令哈希	不确定	不确定	是，支持除 Argon2 以外的所有格式
OpenLDAP 到 389 DS 的复制	-	-	不提供用于复制到 389 DS 的机制
基于时间的一次性口令 (TOTP)	TOTP 叠加组件	-	否，目前不支持
entryUUID	OpenLDAP 的组成部分	插件	是

1	`pam_env.so` 加载 `/etc/security/pam_env.conf` 以设置此文件中指定的环境变量。它可用于将 `DISPLAY` 变量设置为正确的值，因为 `pam_env` 模块知道登录发生的位置。
2	`pam_gnome_keyring.so` 根据 GNOME 密钥环检查用户的登录名和口令。
3	`pam_unix` 根据 `/etc/passwd` 和 `/etc/shadow` 检查用户的登录名和口令。

名称	强制	默认值	说明
id	否	cryptctl	资源组的名称。
cert-path	是		创建的证书的完整路径。
cert-key-path	是		创建的证书密钥的完整路径。
virtual-ip:id	否	cryptctl-vip	cryptctl 服务器的虚拟 IP 资源的 ID。
virtual-ip:ip	是		cryptctl 服务器的 IP 地址。
virtual-ip:nic	否	virtual-ip 资源代理检测到的值。	cryptctl 服务器应侦听的网络设备。仅当无法从 IP 地址检测到设备时才需要提供。
virtual-ip:cidr_netmask	否	virtual-ip 资源代理检测到的值。	cryptctl 服务器 IP 地址的数字网络掩码。仅当无法从 IP 地址检测到网络掩码时才需要提供。
virtual-ip:broadcast	否	virtual-ip 资源代理检测到的值。	cryptctl 服务器 IP 地址的广播地址。仅当无法从 IP 地址检测到此地址时才需要提供。
filesystem:id	否	cryptctl-filesystem	包含磁盘加密密钥和记录的文件系统资源的 ID。
filesystem:device	是		包含文件系统的设备。这可以是块设备（例如 `/dev/sda...`）或 NFS 共享路径 `server:/path`。
filesystem:directory	否	/var/lib/cryptctl/keydb	包含文件系统的设备所在的目录。这可以是块设备（例如 `/dev/sda...`）或 NFS 共享路径 `server:/path`。
filesystem:fstype	是		文件系统类型（例如 NFS、XFS、EXT4）。
filesystem:options	否	所选文件系统的默认选项。	文件系统的挂载选项。

`/etc/login.defs`	`PASS_MAX_DAYS`	口令保持有效的最大天数。
`/etc/login.defs`	`PASS_MIN_DAYS`	自上次更改到用户下次可更改口令之前的最小天数。
`/etc/login.defs`	`PASS_WARN_AGE`	从上次更改口令到下次提醒更改口令间隔的天数。
`/etc/default/useradd`	`INACTIVE`	口令失效后帐户处于禁用状态的天数。
`/etc/default/useradd`	`EXPIRE`	帐户失效日期（采用 YYYY-MM-DD 格式）。

`pam_cracklib.so`	`minlen=8`	口令的最小长度为 8
`pam_cracklib.so`	`lcredit=-1`	小写字母的最少数量为 1
`pam_cracklib.so`	`ucredit=-1`	大写字母的最少数量为 1
`pam_cracklib.so`	`dcredit=-1`	数字的最少数量为 1
`pam_cracklib.so`	`ocredit=-1`	其他字符的最少数量为 1

软件包	外壳特点	外壳变量	时间单位	只读设置	配置路径（仅登录外壳）	配置路径（所有外壳）
`bash`	`bash, sh`	`TMOUT`	秒	`read-only TMOUT=`	`/etc/profile.local`，`/etc/profile.d/`	`/etc/bash.bashrc`
`mksh`	`ksh, lksh, mksh, pdksh`	`TMOUT`	秒	`read-only TMOUT=`	`/etc/profile.local`，`/etc/profile.d/`	`/etc/ksh.kshrc.local`
`tcsh`	`csh, tcsh`	`autologout`	分钟	`set -r autologout=`	`/etc/csh.login.local`	`/etc/csh.cshrc.local`
`zsh`	`zsh`	`TMOUT`	秒	`readonly TMOUT=`	`/etc/profile.local`，`/etc/profile.d/`	`/etc/zsh.zshrc.local`

1	策略文件的根 XML 元素。
2	此策略中唯一操作的定义的开头部分。
3	在此处可以找到上述隐式授权设置。
4	`annotate` 元素包含有关 Polkit 如何执行操作的附加信息。在本例中，此元素包含 gparted 可执行文件的路径，以及用于允许此程序访问图形显示器的设置。必须提供这些批注才能将某个操作与 Polkit 工具 `pkexec` 结合使用。

类型	文本形式
拥有者	`user::rwx`
已命名用户	`user:name:rwx`
所属组	`group::rwx`
已命名组	`group:name:rwx`
掩码	`mask::rwx`
其他	`other::rwx`

项类型	文本形式	权限
已命名用户	`user:geeko:r-x`	`r-x`
掩码	`mask::rw-`	`rw-`
	有效权限：	`r--`

选项	说明
p	检查选定文件或目录的文件权限。
i	检查 inode 编号。每个文件名都有一个不得更改的唯一 inode 编号。
n	检查指向相关文件的链接数。
u	检查文件拥有者是否已更改。
g	检查文件组是否已更改。
s	检查文件大小是否已更改。
b	检查文件使用的块计数是否已更改。
m	检查文件的修改时间是否已更改。
c	检查文件访问时间是否已更改。
S	检查更改的文件大小。
I	忽略文件名的更改。
md5	检查文件的 md5 校验和是否已更改。我们建议使用 sha256 或 sha512。
sha1	检查文件的 sha1（160 位）校验和是否已更改。我们建议使用 sha256 或 sha512。
sha256	检查文件的 sha256 校验和是否已更改。
sha512	检查文件的 sha512 校验和是否已更改。

1	本地计算机到远程计算机
2	远程计算机到本地计算机

原始权限	umask	上载的权限
0666	0002	0664
0600	0002	0600
0775	0025	0750

文件路径	变量名	示例值
`/etc/sysconfig/nfs`	MOUNTD_PORT	21001
	STATD_PORT	21002
	LOCKD_TCPPORT	21003
	LOCKD_UDPPORT	21003
	RQUOTAD_PORT	21004
`/etc/sysconfig/ypbind`	YPBIND_OPTIONS	-p24500
`/etc/sysconfig/ypserv`	YPXFRD_ARGS	-p24501
	YPSERV_ARGS	-p24502
	YPPASSWDD_ARGS	--port 24503

1	OpenVPN 侦听的 TCP/UDP 端口。需要在防火墙中打开该端口，具体请参见第 23 章 “伪装和防火墙”。VPN 的标准端口为 1194，因此您可以将此设置保持不变。
2	协议 UDP 或 TCP。
3	Tun 或 tap 设备。有关两者的差异，请参见第 24.1.1 节 “术语”。
4	以下行包含根服务器 CA 证书 (`ca`)、根 CA 密钥 (`cert`) 和服务器私用密钥 (`key`) 的相对或绝对路径。这些项是在第 24.3.1 节 “创建证书”中生成的。
5	要求依照 RFC3280 TLS 规则明确使用密钥和扩展密钥为对等证书签名。
6	Diffie-Hellman 参数。使用以下命令创建所需的文件： openssl dhparam -out /etc/openvpn/dh2048.pem 2048
7	提供 VPN 子网。可通过 `192.168.1.1` 访问该服务器。
8	在给定文件中记录客户端及其虚拟 IP 地址的映射。当服务器关闭以及客户端（在重启动后）获取以前分配的 IP 地址时很有用。
9	出于安全原因，请以降级的特权运行 OpenVPN 守护程序。为此，请指定应使用组和用户 `nobody`。
10	多个配置选项 — 请参见示例配置文件中的注释：`/usr/share/doc/packages/openvpn/sample-config-files`。
11	启用此选项可将包含统计数据的简短状态更新（“操作状态转储”）写入命名的文件。默认不会启用此选项。所有输出将写入到可通过 `journalctl` 显示的系统日记中。如果您有多个配置文件（例如，一个在家里使用，一个在工作时使用），我们建议在文件名中包含设备名。这可以避免意外重写输出文件。在本例中，设备名是 `tun0`（取自 `dev` 指令）— 请参见3。
12	默认情况下，日志消息将写入 syslog。去除井号字符可重写此行为。在这种情况下，所有消息将写入 `/var/log/openvpn-server.log`。不要忘记配置 logrotate 服务。有关更多详细信息，请参见`man 8 logrotate`。

1	指定此计算机是客户端。
2	网络设备。客户端和服务器必须使用相同的设备。
3	协议。使用与服务器上相同的设置。
5	这是客户端的一个安全选项，确保客户端连接到的主机是指定的服务器。
4	请将占位符 IP_OR_HOST_NAME 替换为 VPN 服务器的相应主机名或 IP 地址。主机名后面提供了服务器端口。您可以设置指向不同 VPN 服务器的多行 `remote` 项。此设置可用来在不同 VPN 服务器之间进行负载平衡。
6	出于安全原因，请以降级的特权运行 OpenVPN 守护程序。为此，请指定应使用组和用户 `nobody`。
7	包含客户端文件。出于安全原因，请为每个客户端单独使用一对文件。
8	开启压缩。请仅在服务器上也启用了压缩时，才使用此参数。

1	第一部分是编号。此编号是侦听程序的进程 ID 编号 (PID)。
2	第二部分是一个字符串，代表侦听程序的绝对路径
3	最后部分表示限制此程序的配置文件（如果存在）。

1	此语句加载包含变量定义的文件。
2	受限制程序的规范化路径。
3	花括号 (`{}`) 用作 include 语句、子配置文件、路径项、功能项和网络项的容器。
4	此指令提取 AppArmor 配置文件的组件以简化配置文件。
5	功能项语句可启用每个 29 POSIX.1e 草案功能。
6	确定允许应用程序进行哪种网络访问的指令。有关详细信息，请参考第 32.5 节 “网络访问控制”。
7	链接对规则，指定链接的源和目标。有关更多信息，请参见第 32.7.6 节 “链接对”。
8	此处的花括号 (`{}`) 允许所列的每个可能的值，其中一个可能的值为空字符串。
9	路径项，指定程序可以访问文件系统的哪些区域。路径项的第一部分指定文件的绝对路径（包括正则表达式通配），第二部分指示允许的访问模式（例如 `r` 表示读，`w` 表示写，`x` 表示执行）。路径的开头可以包含任何类型的空白字符（空格或制表符），但必须以空格分隔路径和模式说明符。可以选择用空格分隔各访问模式并在末端包含尾随逗号。第 32.7 节 “文件权限访问模式”中提供了可用访问模式的综合概述。
10	此变量将扩展为一个无需更改整个配置文件即可更改的值。
11	拥有者条件规则，授予对用户所拥有文件的读写权限。有关更多信息，请参考第 32.7.8 节 “拥有者条件规则”。
12	此项定义了到本地配置文件 `/usr/bin/foobar` 的转换。第 32.12 节 “执行模式”中提供了可用执行模式的综合概述。
13	目标为位于全局范围内的 bin_generic 配置文件的命名配置文件转换。有关详细信息，请参见第 32.12.7 节 “命名配置文件转换”。
14	本地配置文件 `/usr/bin/foobar` 在此部分中定义。
15	此部分引用了应用程序的“帽子”子配置文件。有关 AppArmor ChangeHat 功能的更多细节，请参见第 36 章 “使用 ChangeHat 构建 Web 应用程序的配置文件”。

1	支持的域：`inet`、`ax25`、`ipx`、`appletalk`、`netrom`、`bridge`、`x25`、`inet6`、`rose`、`netbeui`、`security`、`key`、`packet`、`ash`、`econet`、`atmsvc`、`sna`、`pppox`、`wanpipe`、`bluetooth`、`unix`、`atmpvc`、`netlink`、`llc`、`can`、`tipc`、`iucv`、`rxrpc`、`isdn`、`phonet`、`ieee802154`、`caif`、`alg`、`nfc`、`vsock`
2	支持的类型：`stream`、`dgram`、`seqpacket`、`rdm`、`raw`、`packet`
3	支持的协议：`tcp`、`udp`、`icmp`

1	允许所有网络。不应用与域、类型或协议相关的限制。
2	允许 IPv4 网络的一般用法。
3	允许 IPv6 网络的一般用法。
4	允许使用 IPv4 TCP 网络。
5	允许使用 IPv4 TCP 网络（上一条规则的释义）。
6	允许使用 IPv4 和 IPv6 TCP 网络。

`*`	代替任意数目的任何字符，`/` 除外。示例：任意数目的路径元素。
`**`	代替任意数目的字符，包括 `/`。示例：任意数目的路径元素，包括整个目录。
`?`	代替任意单个字符，`/` 除外。
`[abc]`	代替单个 `a`、`b` 或 `c` 字符。示例：匹配 `/home[01]/*/.plan` 的规则允许程序访问 `/home0` 和 `/home1` 中的 `.plan` 用户文件。
`[a-c]`	代替单个 `a`、`b` 或 `c` 字符。
`{ab,cd}`	扩展为一条匹配 `ab` 的规则，以及一条匹配 `cd` 的规则。示例：匹配 `/{usr,www}/pages/**` 的规则授予对 `/usr/pages` 和 `/www/pages` 中网页的访问权限。
`[^a]`	代替除 `a` 之外的其他任何字符。

`r`	读取模式
`w`	写入模式（与 `a` 互斥）
`a`	追加模式（与 `w` 互斥）
`k`	文件锁定模式
`l`	链接模式
`link FILE -> TARGET`	链接对规则（不能与其他访问模式结合使用）

`Px`	离散配置文件执行模式
`Cx`	离散本地配置文件执行模式
`Ux`	未受限执行模式
`ix`	继承执行模式
`m`	允许使用 `mmap(2)` 调用执行 `PROT_EXEC`

部分	类别
1	用户命令
2	系统调用
3	库函数
4	设备驱动程序信息
5	配置文件格式
6	游戏
7	高级概念
8	管理员命令

标志	含义 [可能的值]	命令
`enabled`	设置启用标志。[0..2] 0=禁用，1=启用，2=启用并锁定配置。请注意，此标志会禁用日志记录系统调用，系统仍会记录其他事件。（请参见 audit-devel 中的 `man 3 audit_set_enabled`。）	`auditctl` `-e [0\|1\|2]`
`flag`	设置故障标志。[0..2] 0=静默，1=printk，2=panic（立即暂停且不将等待中数据同步到磁盘）	`auditctl` `-f [0\|1\|2]`
`pid`	正在运行 `auditd` 的进程 ID。	—
`rate_limit`	设置每秒消息数上限。如果该值不为零且每秒消息数超过该上限，将触发故障标志中指定的操作。	`auditctl` `-r RATE`
`backlog_limit`	指定允许的未处理审计缓冲区的最大数目。如果所有缓冲区已满，将触发故障标志中指定的操作。	`auditctl` `-b BACKLOG`
`lost`	统计当前丢失的审计消息数。	—
`backlog`	统计当前未处理的审计缓冲区数。	—

1	指定未处理审计缓冲区的最大数目。根据日志记录活动的级别，您可能需要调整缓冲区的数目，以免系统上的审计负载过于繁重。
2	指定要使用的故障标志。有关可能的值，请参见表 41.1 “审计状态标志”。
3	指定内核每秒可发出的最大消息数目。有关详细信息，请参见表 41.1 “审计状态标志”。
4	启用或禁用审计子系统。

安全和强化指南

前言 #

1 可用文档 #

2 改进文档 #

3 文档约定 #

4 支持 #

4.1 SUSE Linux Enterprise Desktop 支持声明 #

4.2 技术预览 #

1 安全性和机密性 #

1.1 概述 #

1.2 口令 #

1.3 备份 #

1.4 系统完整性 #

1.5 文件访问 #

1.6 网络 #

1.7 软件漏洞 #

1.8 恶意软件 #

1.9 重要安全提示 #

1.10 报告安全问题 #

第 I 部分 身份验证 #

2 通过 PAM 进行身份验证 #

2.1 PAM 是什么？ #

2.2 PAM 配置文件的结构 #

2.3 sshd 的 PAM 配置 #

2.4 PAM 模块的配置 #

2.4.1 pam_env.conf #

2.4.2 pam_mount.conf.xml #

2.4.3 limits.conf #

2.5 使用 pam-config 配置 PAM #

2.6 手动配置 PAM #

2.7 配置本地登录所需的 U2F 密钥 #

2.7.1 将 U2F 密钥与您的帐户关联 #

2.7.2 更新 PAM 配置 #

2.8 更多信息 #

3 使用 NIS #

3.1 配置 NIS 服务器 #

3.2 配置 NIS 客户端 #

4 使用 YaST 设置身份验证客户端 #

4.1 使用 YaST 配置身份验证客户端 #

4.2 SSSD #

4.2.1 检查状态 #

4.2.2 缓存 #

5 使用 389 Directory Server 的 LDAP #

5.1 LDAP 目录树的结构 #

5.2 为 389 Directory Server 创建和管理 Docker 容器 #

5.3 安装 389 Directory Server #

5.3.1 设置新的 389 Directory Server 实例 #

5.3.2 使用自定义配置文件创建 389 Directory Server 实例 #

5.3.3 基于模板创建 389 Directory Server 实例 #

5.3.4 停止和启动 389 Directory Server #

5.3.5 配置用于本地管理的管理员身份凭证 #

5.4 防火墙配置 #

5.5 备份和恢复 389 Directory Server #

5.5.1 备份 LDAP 服务器配置 #

5.5.2 创建 LDAP 数据库的脱机备份并从该备份恢复 #

5.5.3 创建 LDAP 数据库的联机备份并从该备份恢复 #

5.6 管理 LDAP 用户和组 #

5.6.1 查询现有的 LDAP 用户和组 #

5.6.2 创建用户和管理口令 #

5.6.3 创建和管理组 #

5.6.4 删除用户和组以及从组中去除用户 #

5.7 管理插件 #

5.7.1 389 Directory Server 不支持的插件 #

5.8 使用 SSSD 管理 LDAP 身份验证 #

5.8.1 不支持的口令哈希和身份验证方案 #

5.9 从 OpenLDAP 迁移到 389 Directory Server #

5.9.1 测试从 OpenLDAP 迁移 #

5.9.2 测试使用 saslauthd 的 OpenLDAP 服务器迁移 #

5.9.2.1 将 SASL 直通身份验证从 OpenLDAP 迁移到 389 Directory Server #

5.9.2.2 saslauthd 直通身份验证查错 #

5.9.3 规划迁移 #

5.10 导入 TLS 服务器证书和密钥 #

5.11 设置复制 #

5.11.1 异步写入 #

5.11.2 设计拓扑 #

5.11.3 复制拓扑示例 #

5.11.3.1 两个复本 #

5.11.3.2 四个提供者复本 #

5.11.3.3 六个复本 #

5.11.3.4 具有只读使用者的六个复本 #

第 I 部分身份验证 #

5.9.2 测试使用 `saslauthd` 的 OpenLDAP 服务器迁移 #

5.9.2.2 `saslauthd` 直通身份验证查错 #

6.3.4 票据授权－联系所有服务器 #

第 II 部分本地安全性 #

1	`-w` 选项告知审计添加指定文件（在本例中为 `/etc/shadow`）的监测项。请求此文件访问权限的所有系统调用都将经过分析。
2	此规则添加对 `/etc` 目录的监测项，并对读取和执行此目录的访问操作应用权限过滤 (`-p rx`)。请求这两种权限中的任何一种权限的任何系统调用都将经过分析。系统会将创建新文件以及删除现有文件的操作记录为与目录相关的事件。要获取此特定目录下各文件的更具体的事件，应该为每个文件单独添加一条规则。在添加包含文件监测项的规则之前，相应文件必须存在。不支持在创建文件时审计文件。
3	此规则向 `/etc/passwd` 添加一个文件监测项，并对读取、写入、执行和属性更改权限应用权限过滤。`-k` 选项可让您指定一个键，以便日后用来过滤此特定事件的审计日志（例如使用 `ausearch` 过滤）。您可对不同的规则使用相同的键，这样便能在搜索规则时将规则分组。还可以将多个键应用于一条规则。

1	此规则对 `mkdir` 系统调用激活审计。`-a` 选项添加系统调用规则。每当输入 `mkdir` 系统调用（`exit`、`always`）时，此规则就会触发一个事件。`-S` 选项指定应对其应用此规则的系统调用。
2	此规则添加对 access 系统调用的审计，但仅当该系统调用的第二个参数 (`mode`) 为 `4` (`R_OK`) 时会进行审计。`exit,always` 告知审计在进入此系统调用时为其添加审计环境，并在审计此系统调用后输出报告。
3	此规则添加 IPC 多路转换系统调用的审计环境。特定的 `ipc` 系统调用作为第一个系统调用参数传递，可以使用 `-F a0=IPC_CALL_NUMBER` 选择它。
4	此规则审计失败的 open 调用尝试。
5	此规则是任务规则（关键字为 `task`）的示例。它与上述其他规则的不同之处在于，它会应用于派生或克隆的进程。要过滤此类事件，您可以使用派生时已知的字段，例如 UID、GID 和 AUID。此示例规则过滤带有审计 ID `0` 的所有任务。
6	最后这条规则使用了很多过滤器。所有过滤选项都与逻辑 AND 运算符相结合，表示此规则将应用于带有审计 ID `501`、以 `root` 身份运行并使用 `wheel` 作为组的所有任务。系统会在用户登录时为某个进程分配审计 ID。然后，此 ID 将传给用户的初始进程所启动的任何子进程。即使用户更改其身份，审计 ID 也仍会保持不变，可用于跟踪原始用户的操作。

1	清除审计规则的队列并删除任何以前存在的规则。此规则用作 `/etc/audit/audit.rules` 文件中的第一条规则，可确保即将添加的规则不会与任何以前存在的规则相冲突。在执行 `autrace` 之前还需使用 `auditctl` `-D` 命令，以避免跟踪规则与 `audit.rules` 文件中存在的任何规则相冲突。
2	此规则删除某个系统调用规则。`-d` 选项必须位于需要从规则队列中删除的任何系统调用规则的前面，并且必须完全匹配。
3	此规则告知审计从规则队列中丢弃包含 `/etc` 目录监测项的规则。此规则删除任何包含 `/etc` 目录监测项的规则，而不管使用了哪种权限过滤或键选项。

1	PAM 报告它已向远程主机（jupiter.example.com，192.168.2.100）成功请求对 `root` 用户进行身份验证。发生此操作的终端为 `ssh`。
2	PAM 报告它已成功确定是否已授权用户登录。
3	PAM 报告已获取用于登录的适当身份凭证，并且终端已变为正常终端 (`/dev/pts0`)。
4	PAM 报告它已成功为 `root` 打开会话。
5	用户已成功登录。此事件是 `aureport` `-l` 用来报告用户登录的事件。
6	PAM 报告已成功重新获取身份凭证。

1	在开始定义新规则之前，请删除所有以前存在的规则。
2	设置用于容纳审计消息的缓冲区数目。根据系统上的审计日志记录级别增大或减小此数字。
3	设置当内核需要处理严重错误时要使用的故障标志。可能的值为 `0`（静默）、`1`（printk，列显故障消息）和 `2`（panic，暂停系统）。

1	设置审计日志所在目录的监测项。对任何类型访问此目录的尝试均触发事件。如果您在使用日志轮换，请另外也添加所轮换日志的监测项。
2	设置审计配置文件的监测项。记录对此文件的所有写入和属性更改尝试。

1	对与文件所有权和权限更改相关的系统调用启用审计环境。根据系统的硬件体系结构启用或禁用 `32` 规则。AMD64/Intel 64 等 64 位系统要求去除 `32` 规则。
2	对文件内容修改相关的系统调用启用审计环境。根据系统的硬件体系结构启用或禁用 64 规则。AMD64/Intel 64 等 64 位系统要求去除 64 规则。
3	对任何目录操作（例如创建或去除目录）启用审计环境。
4	对任何链接操作（例如创建符号链接、创建链接、取消链接或重命名）启用审计环境。
5	对扩展文件系统属性相关的任何操作启用审计环境。
6	对用于创建特殊（设备）文件的 `mknod` 系统调用启用审计环境。
7	对任何挂载或卸载操作启用审计环境。对于 x86 体系结构，请禁用 `umount` 规则。对于 Intel 64 体系结构，请禁用 `umount2` 规则。

1	设置 `at` 和 `cron` 配置及已安排作业的监测项，并向这些事件分配标签。
2	设置用户、组、口令、登录数据库和日志的监测项，并设置标签以更好地识别任何与登录相关的事件，例如失败的登录尝试。
3	对 `/etc/hosts` 中的静态主机名配置设置监测项和标签。跟踪对系统配置目录 `/etc/sysconfig` 的更改。如果您要跟踪文件事件，请启用每个文件的监测项。对 `/etc/init.d` 目录中的引导配置发生的更改设置监测项和标签。如果您要跟踪文件事件，请启用每个文件的监测项。对 `/etc/ld.so.conf` 中的链接器配置发生的任何更改设置监测项和标签。对 `/etc/localtime` 设置监测项和标签。对内核配置文件 `/etc/sysctl.conf`、`/etc/modprobe.d/`、`/etc/modprobe.conf.local` 和 `/etc/modprobe.conf` 设置监测项和标签。
4	设置 PAM 配置目录的监测项。如果您要跟踪目录级别下的特定文件，还需添加这些文件的明确监测项。
5	设置 postfix 配置的监测项，以在日志中记录任何写入尝试或属性更改，并使用标签来更好地进行跟踪。
6	对 SSH、`stunnel` 和 `vsftpd` 配置文件设置监测项和标签。
7	执行对 `sethostname` 系统调用的审计，并对 `/etc/issue` 与 `/etc/issue.net` 中的系统标识配置设置监测项和标签。

1	跟踪任务创建。
2	添加 umask 系统调用的审计环境。
3	跟踪尝试更改系统时间的操作。可以使用 `adjtimex` 来调整时间。`settimeofday` 设置绝对时间。

1	审计 access 系统调用，但仅当该系统调用的第二个参数 (`mode`) 为 `4` (`R_OK`) 时进行审计。此规则会过滤所有用于测试对用户或进程所访问的文件或文件系统是否拥有适当读取权限的 access 调用。
2	审计 access 系统调用，但仅当该系统调用的第二个参数 (`mode`) 为 `6`（即 `4 OR 2`，将转换为 `R_OK OR W_OK`）时进行审计。此规则会过滤用于测试是否拥有适当读取和写入权限的 access 调用。
3	审计 access 系统调用，但仅当该系统调用的第二个参数 (`mode`) 为 `7`（即 `4 OR 2 OR 1`，将转换为 `R_OK OR W_OK OR X_OK`）时进行审计。此规则会过滤用于测试是否拥有适当读取、写入和执行权限的 access 调用。