SUSE Linux Enterprise Server 12 SP4 Security Guide Security Guide SUSE Linux Enterprise Server 12 SP4 Introduces basic concepts of system security, covering both local and network security aspects. Shows how to use the product inherent security software like AppArmor or the auditing system that reliably collects information about any security-relevant events. Publication Date: September 24, 2021 SUSE LLC 1800 South Novell Place Provo, UT 84606 USA https://documentation.suse.com Copyright © 2006– 2021 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its aliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its aliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof. Contents About This Guide xvi 1 Available Documentation xvi 2 Giving Feedback xviii 3 Documentation Conventions xviii 4 Product Life Cycle and Support xx Support Statement for SUSE Linux Enterprise Server xxi • Technology Previews xxii 1 Security and Confidentiality 1 1.1 Local Security and Network Security 1 Local Security 3 • Network Security 6 1.2 Some General Security Tips and Tricks 10 1.3 Using the Central Security Reporting Address 12 I AUTHENTICATION 13 2 Authentication with PAM 14 2.1 What is PAM? 14 2.2 Structure of a PAM Configuration File 15 2.3 The PAM Configuration of sshd 17 2.4 Configuration of PAM Modules 20 pam_env.conf 20 • pam_mount.conf.xml 21 • limits.conf 21 2.5 Configuring PAM Using pam-config 22 2.6 Manually Configuring PAM 23 2.7 For More Information 23 iii Security Guide 3 Using NIS 25 3.1 Configuring NIS Servers 25 Configuring a NIS Master Server 26 • Configuring a NIS Slave Server 30 3.2 Configuring NIS Clients 31 4 Setting Up Authentication Servers and Clients Using YaST 33 4.1 Configuring an Authentication Server with YaST 33 Initial Configuration of an Authentication Server 33 • Editing an Authentication Server Configuration with YaST 37 • Editing LDAP Users and Groups 42 4.2 Configuring an Authentication Client with YaST 42 4.3 SSSD 43 Checking the Status 43 • Caching 43 • For More Information 44 5 LDAP—A Directory Service 45 5.1 LDAP versus NIS 46 5.2 Structure of an LDAP Directory Tree 46 5.3 Configuring an LDAP Client with YaST 49 5.4 Configuring LDAP Users and Groups in YaST 51 5.5 Manually Configuring an LDAP Server 52 5.6 Manually Administering LDAP Data 53 Inserting Data into an LDAP Directory 53 • Modifying Data in the LDAP Directory 55 • Searching or Reading Data from an LDAP Directory 56 • Deleting Data from an LDAP Directory 57 5.7 For More Information 57 6 Network Authentication with Kerberos 59 6.1 Conceptual Overview 59 6.2 Kerberos Terminology 59 iv Security Guide 6.3 How Kerberos Works 61 First Contact 61 • Requesting a Service 62 • Mutual Authentication 63 • Ticket Granting—Contacting All Servers 63 6.4 User View of Kerberos 64 6.5 Installing and Administering Kerberos 65 Kerberos Network Topology 66 • Choosing the Kerberos Realms 67 • Setting Up the KDC Hardware 67 • Configuring Time Synchronization 68 • Configuring the KDC 69 • Configuring Kerberos Clients 72 • Configuring Remote Kerberos Administration 75 • Creating Kerberos Service Principals 76 • Enabling PAM Support for Kerberos 78 • Configuring SSH for Kerberos Authentication 79 • Using LDAP and Kerberos 80 6.6 Setting up Kerberos using LDAP and Kerberos Client 82 6.7 Kerberos and NFS 85 Group Membership 86 • Performance and Scalability 87 • Master KDC, Multiple Domains, and Trust Relationships 88 6.8 For More Information 88 7 Active Directory Support 90 7.1 Integrating Linux and Active Directory Environments 90 7.2 Background Information for Linux Active Directory Support 91 Domain Join 93 • Domain Login and User Homes 94 • Offline Service and Policy Support 95 7.3 Configuring a Linux Client for Active Directory 96 Choosing Which YaST Module to Use for Connecting to Active Directory 97 • Joining Active Directory Using User Logon Management 98 • Joining Active Directory Using Windows Domain Membership 102 • Checking Active Directory Connection Status 105 7.4 Logging In to an Active Directory Domain 105 GDM 105 • Console Login 106 7.5 Changing Passwords 106 v Security Guide II LOCAL SECURITY 108 8 Configuring Security Settings with YaST 109 8.1 Security Overview 109 8.2 Predefined Security Configurations 110 8.3 Password Settings 111 8.4 Boot Settings 112 8.5 Login Settings 112 8.6 User Addition 112 8.7 Miscellaneous Settings 112 9 Authorization with PolKit 114 9.1 Conceptual Overview 114 Available Authentication Agents 114 • Structure of PolKit 114 • Available Commands 115 • Available Policies and Supported Applications 115 9.2 Authorization Types 117 Implicit Privileges 117 • Explicit Privileges 117 • Default Privileges 118 9.3 Querying Privileges 118 9.4 Modifying Configuration Files 119 Adding Action Rules 119 • Adding Authorization Rules 120 • Modifying Configuration Files for Implicit Privileges 121 9.5 Restoring the Default Privileges 122 10 Access Control Lists in Linux 124 10.1 Traditional File Permissions 124 The setuid Bit 124 • The setgid Bit 125 • The Sticky Bit 125 10.2 Advantages of ACLs 125 10.3 Definitions 126 vi Security Guide 10.4 Handling ACLs 127 ACL Entries and File Mode Permission Bits 128 • A Directory with an ACL 129 • A Directory with a Default ACL 131 • The ACL Check Algorithm 134 10.5 ACL Support in Applications 135 10.6 For More Information 135 11 Encrypting Partitions and Files 136 11.1 Setting Up an Encrypted File System with YaST 137 Creating an Encrypted Partition during Installation 137 • Creating an Encrypted Partition on a Running System 138 • Creating an Encrypted Virtual Disk 139 • Encrypting the Content of Removable Media 139 11.2 Using Encrypted Home Directories 140 11.3 Encrypting Files with GPG 141 12 Certificate Store 142 12.1 Activating Certificate Store 142 12.2 Importing Certificates 142 13 Intrusion Detection with AIDE 144 13.1 Why Use AIDE? 144 13.2 Setting Up an AIDE Database 144 13.3 Local AIDE Checks 147 13.4 System Independent Checking 148 13.5 For More Information 149 III NETWORK SECURITY 150 14 SSH: Secure Network Operations 151 14.1 ssh—Secure Shell 151 Starting X Applications on a Remote Host 152 • Agent Forwarding 152 vii Security Guide 14.2 scp—Secure Copy 152 14.3 sftp—Secure File Transfer 153 Using sftp 153 • Setting Permissions for File Uploads 154 14.4 The SSH Daemon (sshd) 155 Maintaining SSH Keys 156 • Rotating Host Keys 156 14.5 SSH Authentication Mechanisms 157 Generating an SSH Key 158 • Copying an SSH Key 158 • Using the ssh- agent 159 14.6 Port Forwarding 160 14.7 For More Information 160 15 Masquerading and Firewalls 162 15.1 Packet Filtering with iptables 162 15.2 Masquerading Basics 165 15.3 Firewalling Basics 166 15.4 SuSEFirewall2 167 Configuring the Firewall with YaST 168 • Configuring Manually 169 15.5 For More Information 172 16 Configuring a VPN Server 173 16.1 Conceptual Overview 173 Terminology 173 • VPN Scenarios 174 16.2 Setting Up a Simple Test Scenario 178 Configuring the VPN Server 179 • Configuring the VPN Clients 180 • Testing the VPN Example Scenario 181 16.3 Setting Up Your VPN Server Using a Certificate Authority 182 Creating Certificates 182 • Configuring the VPN Server 185 • Configuring the VPN Clients 187 16.4 Setting Up a VPN Server or Client Using YaST 188 viii Security Guide 16.5 For More Information 189 17 Managing X.509 Certification 191 17.1 The Principles of Digital Certification 191 Key Authenticity 192 • X.509 Certificates 192 • Blocking X.509 Certificates 193 • Repository for Certificates and CRLs 194 • Proprietary PKI 195 17.2 YaST Modules for CA Management 195 Creating a Root CA 195 • Changing Password 197 • Creating or Revoking a Sub-CA 198 • Creating or Revoking User Certificates 200 • Changing Default Values 201 • Creating Certificate Revocation Lists (CRLs) 202 • Exporting CA Objects to LDAP 203 • Exporting CA Objects as a File 204 • Importing Common Server Certificates 205 IV CONFINING PRIVILEGES WITH APPARMOR 206 18 Introducing AppArmor 207 18.1 AppArmor Components 207 18.2 Background Information on AppArmor Profiling 208 19 Getting Started 209 19.1 Installing AppArmor 209 19.2 Enabling and Disabling AppArmor 210 19.3 Choosing Applications to Profile 211 19.4 Building and Modifying Profiles 211 19.5 Updating Your Profiles 213 20 Immunizing Programs 214 20.1 Introducing the AppArmor Framework 215 20.2 Determining Programs to Immunize 217 20.3 Immunizing cron Jobs 218 ix Security Guide 20.4 Immunizing Network Applications 218 Immunizing Web Applications 220 • Immunizing Network Agents 222 21 Profile Components and Syntax 223 21.1 Breaking an AppArmor Profile into Its Parts 224 21.2 Profile Types 226 Standard Profiles 226 • Unattached Profiles 227 • Local Profiles 227 • Hats 228 • Change rules 228 21.3 Include Statements 229 Abstractions 230 • Program Chunks 231 • Tunables 231 21.4 Capability Entries (POSIX.1e)