openSUSE Leap 15.3 Security and Hardening Guide Security and Hardening Guide openSUSE Leap 15.3 This guide introduces basic concepts of system security and describes the usage of security software included with the product, such as AppArmor, SELinux, or the auditing system. The guide also supports system administrators in hardening an installation. Publication Date: June 22, 2021 SUSE LLC 1800 South Novell Place Provo, UT 84606 USA https://documentation.suse.com Copyright © 2006– 2021 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its aliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its aliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof. Contents Preface xviii 1 Available documentation xviii 2 Improving the documentation xviii 3 Documentation conventions xix 1 Security and confidentiality 1 1.1 Overview 1 1.2 Passwords 2 1.3 Backups 2 1.4 System integrity 3 1.5 File access 4 1.6 Networking 4 1.7 Software vulnerabilities 5 1.8 Malware 6 1.9 Important security tips 7 1.10 Reporting security issues 7 2 Common Criteria 8 2.1 Introduction 8 2.2 Evaluation Assurance Level (EAL) 8 2.3 Generic guiding principles 9 2.4 More information 11 iii Security and Hardening Guide I AUTHENTICATION 13 3 Authentication with PAM 14 3.1 What is PAM? 14 3.2 Structure of a PAM configuration file 15 3.3 The PAM configuration of sshd 17 3.4 Configuration of PAM modules 20 pam_env.conf 20 • pam_mount.conf.xml 21 • limits.conf 21 3.5 Configuring PAM using pam-config 21 3.6 Manually configuring PAM 22 3.7 More information 23 4 Using NIS 24 4.1 Configuring NIS servers 24 Configuring a NIS master server 24 • Configuring a NIS slave server 29 4.2 Configuring NIS clients 30 5 Setting up authentication clients using YaST 32 5.1 Configuring an authentication client with YaST 32 5.2 SSSD 32 Checking the status 33 • Caching 33 6 389 LDAP Directory Server 34 6.1 Structure of an LDAP directory tree 34 6.2 Installing 389 Directory Server 37 Setting up a new 389 Directory Server instance 37 • Creating a 389 Directory Server instance with a custom configuration file 38 • Creating a 389 Directory Server instance from a template 40 • Stopping and starting 389 Directory Server 41 • Configuring admin credentials for local administration 42 6.3 Firewall configuration 43 iv Security and Hardening Guide 6.4 Managing LDAP users and groups 43 6.5 Setting up SSSD 45 6.6 Managing modules 47 6.7 Migrating to 389 Directory Server from OpenLDAP 47 Testing migration from OpenLDAP 48 • Planning your migration 50 6.8 Using CA certificates for TLS 52 6.9 More information 53 7 Network authentication with Kerberos 54 7.1 Conceptual overview 54 7.2 Kerberos terminology 54 7.3 How Kerberos works 56 First contact 56 • Requesting a service 57 • Mutual authentication 58 • Ticket granting—contacting all servers 58 7.4 User view of Kerberos 59 7.5 Installing and administering Kerberos 60 Kerberos network topology 61 • Choosing the Kerberos realms 62 • Setting up the KDC hardware 62 • Configuring time synchronization 63 • Configuring the KDC 64 • Configuring Kerberos clients 68 • Configuring remote Kerberos administration 70 • Creating Kerberos service principals 72 • Enabling PAM support for Kerberos 74 • Configuring SSH for Kerberos authentication 74 • Using LDAP and Kerberos 75 7.6 Kerberos and NFS 78 Group membership 79 • Performance and scalability 80 • Master KDC, multiple domains, and trust relationships 81 7.7 More information 82 8 Active Directory support 83 8.1 Integrating Linux and Active Directory environments 83 v Security and Hardening Guide 8.2 Background information for Linux Active Directory support 84 Domain join 86 • Domain login and user homes 87 • Offline service and policy support 88 8.3 Configuring a Linux client for Active Directory 89 Choosing which YaST module to use for connecting to Active Directory 90 • Joining Active Directory using User logon management 90 • Joining Active Directory using Windows domain membership 95 • Checking Active Directory connection status 97 8.4 Logging in to an Active Directory domain 98 GDM 98 • Console login 98 8.5 Changing passwords 99 9 Setting up a freeRADIUS server 101 9.1 Installation and testing on SUSE Linux Enterprise 101 II LOCAL SECURITY 104 10 Physical security 105 10.1 System locks 105 10.2 Locking down the BIOS 106 10.3 Security via the boot loaders 107 10.4 Retiring Linux servers with sensitive data 107 scrub: disk overwrite utility 108 10.5 Restricting access to removable media 109 11 Automatic security checks with seccheck 111 11.1 Seccheck timers 111 11.2 Enabling seccheck timers 111 11.3 Daily, weekly, and monthly checks 112 11.4 Automatic logout 114 vi Security and Hardening Guide 12 Software management 115 12.1 Removing unnecessary software packages (RPMs) 115 12.2 Patching Linux systems 117 YaST Online Update 118 • Automatic Online Update 118 • Repository Mirroring Tool—RMT 118 • SUSE Manager 119 13 File management 121 13.1 Disk partitions 121 13.2 Checking file permissions and ownership 122 13.3 Default umask 122 13.4 SUID/SGID files 123 13.5 World-writable files 124 13.6 Orphaned or unowned files 125 14 Encrypting partitions and files 126 14.1 Setting up an encrypted file system with YaST 126 Creating an encrypted partition during installation 127 • Creating an encrypted partition on a running system 128 • Encrypting the content of removable media 128 14.2 Encrypting files with GPG 129 15 Storage encryption for hosted applications with cryptctl 130 15.1 Setting up a cryptctl server 131 15.2 Setting up a cryptctl client 133 15.3 Checking partition unlock status using server-side commands 136 15.4 Unlocking encrypted partitions manually 137 15.5 Maintenance downtime procedure 137 15.6 More information 137 vii Security and Hardening Guide 16 User management 138 16.1 Various account checks 138 Unlocked accounts 138 • Unused accounts 138 16.2 Enabling password aging 139 16.3 Stronger password enforcement 141 16.4 Password and login management with PAM 141 Password strength 142 • Restricting use of previous passwords 143 • Locking user accounts after too many login failures 144 16.5 Restricting root logins 145 Restricting local text console logins 145 • Restricting graphical session logins 147 • Restricting SSH logins 147 16.6 Setting an inactivity timeout for interactive shell sessions 148 16.7 Preventing accidental denial of service 150 Example for restricting system resources 150 16.8 Displaying login banners 153 16.9 Connection accounting utilities 154 17 Spectre/Meltdown checker 155 17.1 Using spectre-meltdown-checker 155 17.2 More information 157 18 Configuring security settings with YaST 158 18.1 Security overview 158 18.2 Predefined security configurations 159 18.3 Password settings 160 18.4 Boot settings 161 18.5 Login settings 161 18.6 User addition 161 viii Security and Hardening Guide 18.7 Miscellaneous settings 161 19 Authorization with PolKit 163 19.1 Conceptual overview 163 Available authentication agents 163 • Structure of PolKit 163 • Available commands 164 • Available policies and supported applications 164 19.2 Authorization types 166 Implicit privileges 166 • Explicit privileges 167 • Default privileges 167 19.3 Querying privileges 167 19.4 Modifying configuration files 168 Adding action rules 168 • Adding authorization rules 169 • Modifying configuration files for implicit privileges 170 19.5 Restoring the default privileges 171 20 Access control lists in Linux 173 20.1 Traditional file permissions 173 The setuid bit 174 • The setgid bit 174 • The sticky bit 175 20.2 Advantages of ACLs 175 20.3 Definitions 175 20.4 Handling ACLs 176 ACL entries and file mode permission bits 177 • A directory with an ACL 178 • A directory with a default ACL 181 • The ACL check algorithm 183 20.5 ACL support in applications 184 20.6 More information 184 21 Certificate store 185 21.1 Activating certificate store 185 21.2 Importing certificates 185 ix Security and Hardening Guide 22 Intrusion detection with AIDE 187 22.1 Why use AIDE? 187 22.2 Setting up an AIDE database 187 22.3 Local AIDE checks 190 22.4 System independent checking 191 22.5 More information 192 III NETWORK SECURITY 194 23 X Window System and X authentication 195 24 SSH: secure network operations 196 24.1 ssh—secure shell 196 Starting X applications on a remote host 197 • Agent forwarding 197 24.2 scp—secure copy 197 24.3 sftp—secure file transfer 198 Using sftp 198 • Setting permissions for file uploads 199 24.4 The SSH daemon (sshd) 200 Maintaining SSH keys 201 • Rotating host keys 201 24.5 SSH authentication mechanisms 202 Generating an SSH key 203 • Copying an SSH key 203 • Using the ssh- agent 204 24.6 Port forwarding 205 24.7 Adding and removing public keys on an installed system 206 24.8 More information 206 25 Masquerading and firewalls 208 25.1 Packet filtering with iptables 208 25.2 Masquerading