Security Guide openSUSE Leap 15.1 Security Guide openSUSE Leap 15.1 Introduces basic concepts of system security, covering both local and network secu- rity aspects. Shows how to use the product inherent security software like AppAr- mor or the auditing system that reliably collects information about any security-rel- evant events. Publication Date: April 21, 2020 SUSE LLC 10 Canal Park Drive Suite 200 Cambridge MA 02141 USA https://www.suse.com/documentation Copyright © 2006– 2020 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its affiliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof. Contents About This Guide xv Support Statement for openSUSE Leap xix • Technology Previews xx 1 Security and Confidentiality 1 1.1 Overview 1 1.2 Passwords 2 1.3 System Integrity 2 1.4 File Access 3 1.5 Networking 3 1.6 Software Vulnerabilities 4 1.7 Malware 5 1.8 Important Security Tips 6 1.9 Reporting Security Issues 6 I AUTHENTICATION 7 2 Authentication with PAM 8 2.1 What is PAM? 8 2.2 Structure of a PAM Configuration File 9 2.3 The PAM Configuration of sshd 11 2.4 Configuration of PAM Modules 14 pam_env.conf 14 • pam_mount.conf.xml 15 • limits.conf 15 2.5 Configuring PAM Using pam-config 15 2.6 Manually Configuring PAM 16 2.7 For More Information 17 iii Security Guide 3 Using NIS 18 3.1 Configuring NIS Servers 18 Configuring a NIS Master Server 18 • Configuring a NIS Slave Server 23 3.2 Configuring NIS Clients 24 4 Setting Up Authentication Clients Using YaST 26 4.1 Configuring an Authentication Client with YaST 26 4.2 SSSD 26 Checking the Status 27 • Caching 27 5 LDAP—A Directory Service 28 5.1 Structure of an LDAP Directory Tree 28 5.2 Installing the Software for 389 Directory Server 31 5.3 Manually Configuring a 389 Directory Server 31 Creating the 389 Directory Server Instance 32 • Using CA Certificates for TSL 33 • Configuring Admin Credentials for Remote/Local Access 34 • Configuring LDAP Users and Groups 35 • Setting Up SSSD 37 5.4 Setting Up a 389 Directory Server with YaST 39 Creating an 389 Directory Server Instance with YaST 39 • Configuring an LDAP Client with YaST 40 5.5 Manually Administering LDAP Data 43 5.6 For More Information 43 6 Network Authentication with Kerberos 44 6.1 Conceptual Overview 44 6.2 Kerberos Terminology 44 6.3 How Kerberos Works 46 First Contact 46 • Requesting a Service 47 • Mutual Authentication 48 • Ticket Granting—Contacting All Servers 48 iv Security Guide 6.4 User View of Kerberos 49 6.5 Installing and Administering Kerberos 50 Kerberos Network Topology 51 • Choosing the Kerberos Realms 52 • Setting Up the KDC Hardware 52 • Configuring Time Synchronization 53 • Configuring the KDC 54 • Configuring Kerberos Clients 58 • Configuring Remote Kerberos Administration 60 • Creating Kerberos Service Principals 62 • Enabling PAM Support for Kerberos 64 • Configuring SSH for Kerberos Authentication 64 • Using LDAP and Kerberos 65 6.6 Setting up Kerberos using LDAP and Kerberos Client 68 6.7 Kerberos and NFS 72 Group Membership 73 • Performance and Scalability 74 • Master KDC, Multiple Domains, and Trust Relationships 75 6.8 For More Information 76 7 Active Directory Support 77 7.1 Integrating Linux and Active Directory Environments 77 7.2 Background Information for Linux Active Directory Support 78 Domain Join 80 • Domain Login and User Homes 81 • Offline Service and Policy Support 82 7.3 Configuring a Linux Client for Active Directory 83 Choosing Which YaST Module to Use for Connecting to Active Directory 84 • Joining Active Directory Using User Logon Management 84 • Joining Active Directory Using Windows Domain Membership 89 • Checking Active Directory Connection Status 91 7.4 Logging In to an Active Directory Domain 92 GDM 92 • Console Login 92 7.5 Changing Passwords 93 v Security Guide II LOCAL SECURITY 95 8 Spectre/Meltdown Checker 96 8.1 Using spectre-meltdown-checker 96 8.2 Additional Information about Spectre/Meltdown 98 9 Configuring Security Settings with YaST 99 9.1 Security Overview 99 9.2 Predefined Security Configurations 100 9.3 Password Settings 101 9.4 Boot Settings 102 9.5 Login Settings 102 9.6 User Addition 102 9.7 Miscellaneous Settings 102 10 Authorization with PolKit 104 10.1 Conceptual Overview 104 Available Authentication Agents 104 • Structure of PolKit 104 • Available Commands 105 • Available Policies and Supported Applications 105 10.2 Authorization Types 107 Implicit Privileges 107 • Explicit Privileges 108 • Default Privileges 108 10.3 Querying Privileges 108 10.4 Modifying Configuration Files 109 Adding Action Rules 109 • Adding Authorization Rules 110 • Modifying Configuration Files for Implicit Privileges 111 10.5 Restoring the Default Privileges 112 11 Access Control Lists in Linux 114 11.1 Traditional File Permissions 114 The setuid Bit 115 • The setgid Bit 115 • The Sticky Bit 116 vi Security Guide 11.2 Advantages of ACLs 116 11.3 Definitions 116 11.4 Handling ACLs 117 ACL Entries and File Mode Permission Bits 118 • A Directory with an ACL 119 • A Directory with a Default ACL 122 • The ACL Check Algorithm 124 11.5 ACL Support in Applications 125 11.6 For More Information 125 12 Encrypting Partitions and Files 126 12.1 Setting Up an Encrypted File System with YaST 126 Creating an Encrypted Partition during Installation 127 • Creating an Encrypted Partition on a Running System 128 • Encrypting the Content of Removable Media 128 12.2 Encrypting Files with GPG 129 13 Certificate Store 130 13.1 Activating Certificate Store 130 13.2 Importing Certificates 130 14 Intrusion Detection with AIDE 132 14.1 Why Use AIDE? 132 14.2 Setting Up an AIDE Database 132 14.3 Local AIDE Checks 135 14.4 System Independent Checking 137 14.5 For More Information 138 vii Security Guide III NETWORK SECURITY 139 15 X Window System and X Authentication 140 16 SSH: Secure Network Operations 141 16.1 ssh—Secure Shell 141 Starting X Applications on a Remote Host 142 • Agent Forwarding 142 16.2 scp—Secure Copy 142 16.3 sftp—Secure File Transfer 143 Using sftp 143 • Setting Permissions for File Uploads 144 16.4 The SSH Daemon (sshd) 145 Maintaining SSH Keys 146 • Rotating Host Keys 146 16.5 SSH Authentication Mechanisms 147 Generating an SSH Key 148 • Copying an SSH Key 148 • Using the ssh- agent 149 16.6 Port Forwarding 150 16.7 Adding and Removing Public Keys on an Installed System 151 16.8 For More Information 151 17 Masquerading and Firewalls 153 17.1 Packet Filtering with iptables 153 17.2 Masquerading Basics 156 17.3 Firewalling Basics 157 17.4 firewalld 158 Configuring the Firewall on the Command Line 159 • Accessing Services Listening on Dynamic Ports 164 17.5 Migrating From SuSEfirewall2 167 17.6 For More Information 169 viii Security Guide 18 Configuring a VPN Server 170 18.1 Conceptual Overview 170 Terminology 170 • VPN Scenarios 171 18.2 Setting Up a Simple Test Scenario 173 Configuring the VPN Server 174 • Configuring the VPN Clients 175 • Testing the VPN Example Scenario 176 18.3 Setting Up Your VPN Server Using a Certificate Authority 177 Creating Certificates 177 • Configuring the VPN Server 178 • Configuring the VPN Clients 180 18.4 Setting Up a VPN Server or Client Using YaST 181 18.5 For More Information 182 IV CONFINING PRIVILEGES WITH APPARMOR 183 19 Introducing AppArmor 184 19.1 AppArmor Components 184 19.2 Background Information on AppArmor Profiling 184 20 Getting Started 186 20.1 Installing AppArmor 186 20.2 Enabling and Disabling AppArmor 187 20.3 Choosing Applications to Profile 188 20.4 Building and Modifying Profiles 188 20.5 Updating Your Profiles 190 21 Immunizing Programs 191 21.1 Introducing the AppArmor Framework 192 21.2 Determining Programs to Immunize 194 21.3 Immunizing cron Jobs 195 ix Security Guide 21.4 Immunizing Network Applications 195 Immunizing Web Applications 197 • Immunizing Network Agents 199 22 Profile Components and Syntax 200 22.1 Breaking an AppArmor Profile into Its Parts 201 22.2 Profile Types 203 Standard Profiles 203 • Unattached Profiles 204 • Local Profiles 204 • Hats 205 • Change rules 205 22.3 Include Statements 206 Abstractions 208 • Program Chunks 208 • Tunables 208 22.4 Capability Entries (POSIX.1e) 208 22.5 Network Access Control 209 22.6 Profile Names, Flags, Paths, and Globbing 210 Profile Flags 211 • Using Variables in Profiles 212 • Pattern Matching 213 • Namespaces 214 • Profile Naming and Attachment Specification 214 • Alias Rules 215 22.7 File Permission Access Modes 215 Read Mode (r) 216 • Write Mode (w) 216 • Append Mode (a) 216 • File Locking Mode (k) 216 • Link Mode (l) 217 • Link Pair 217 • Optional allow and file Rules 217 • Owner Conditional Rules 218 • Deny Rules 219 22.8 Mount Rules 219 22.9 Pivot Root Rules 221 22.10 PTrace Rules 222 22.11 Signal Rules 222 22.12 Execute Modes 223 Discrete Profile Execute Mode (Px)