Novell LINUX ENTERPRISE DESKTOP 11 User manual

SUSE Linux Enterprise

Server

www.novell.com11

March17,2009 Security Guide

Security Guide

Legal Notice

This manual is protected under Novell intellectual property rights. By reproducing, duplicating or

distributing this manual you explicitly agree to conform to the terms and conditions of this license

agreement.

This manual may be freely reproduced, duplicated and distributed either as such or as part of a bundled

package in electronic and/or printed format, provided however that the following conditions are ful-

lled:

That this copyright notice and the names of authors and contributors appear clearly and distinctively

on all reproduced, duplicated and distributed copies. That this manual, specically for the printed

format, is reproduced and/or distributed for noncommercial use only. The express authorization of

Novell, Inc must be obtained prior to any other use of any manual or part thereof.

For Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell

.com/company/legal/trademarks/tmlist.html. * Linux is a registered trademark of

Linus Torvalds. All other third party trademarks are the property of their respective owners. A trademark

symbol (®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes a third party trademark.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,

nor the translators shall be held liable for possible errors or the consequences thereof.

Contents

About This Guide xi

1Security and Condentiality 1

1.1 Local Security and Network Security . . . . . . . . . . . . . . . . . 2

1.2 Some General Security Tips and Tricks . . . . . . . . . . . . . . . . 11

1.3 Using the Central Security Reporting Address . . . . . . . . . . . . . 14

Part I Authentication 15

2Authentication with PAM 17

2.1 Structure of a PAM Conguration File . . . . . . . . . . . . . . . . 18

2.2 The PAM Conguration of sshd . . . . . . . . . . . . . . . . . . . 20

2.3 Conguration of PAM Modules . . . . . . . . . . . . . . . . . . . 22

2.4 Conguring PAM Using pam-cong . . . . . . . . . . . . . . . . . 24

2.5 For More Information . . . . . . . . . . . . . . . . . . . . . . . 26

3Using NIS 27

3.1 Conguring NIS Servers . . . . . . . . . . . . . . . . . . . . . . 27

3.2 Conguring NIS Clients . . . . . . . . . . . . . . . . . . . . . . 33

4LDAP—A Directory Service 35

4.1 LDAPversusNIS......................... 36

4.2 Structure of an LDAP Directory Tree . . . . . . . . . . . . . . . . . 37

4.3 Conguring an LDAP Server with YaST . . . . . . . . . . . . . . . . 40

4.4 Conguring an LDAP Client with YaST . . . . . . . . . . . . . . . . 49

4.5 Conguring LDAP Users and Groups in YaST . . . . . . . . . . . . . . 57

4.6 Browsing the LDAP Directory Tree . . . . . . . . . . . . . . . . . . 59

4.7 Manually Conguring an LDAP Server . . . . . . . . . . . . . . . . 60

4.8 Manually Administering LDAP Data . . . . . . . . . . . . . . . . . 61

4.9 For More Information . . . . . . . . . . . . . . . . . . . . . . . 65

5Active Directory Support 67

5.1 Integrating Linux and AD Environments . . . . . . . . . . . . . . . . 67

5.2 Background Information for Linux AD Support . . . . . . . . . . . . 68

5.3 Conguring a Linux Client for Active Directory . . . . . . . . . . . . 74

5.4 Logging In to an AD Domain . . . . . . . . . . . . . . . . . . . . 77

5.5 Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . . 79

6Network Authentication with Kerberos 81

6.1 Kerberos Terminology . . . . . . . . . . . . . . . . . . . . . . . 82

6.2 How Kerberos Works . . . . . . . . . . . . . . . . . . . . . . . 83

6.3 Users' View of Kerberos . . . . . . . . . . . . . . . . . . . . . . 86

6.4 Installing and Administering Kerberos . . . . . . . . . . . . . . . . 87

6.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 108

7Using the Fingerprint Reader 109

7.1 Supported Applications and Actions . . . . . . . . . . . . . . . . 109

7.2 Managing Fingerprints with YaST . . . . . . . . . . . . . . . . . . 110

Part II Local Security 113

8Conguring Security Settings with YaST 115

8.1 Security Overview . . . . . . . . . . . . . . . . . . . . . . . . 115

8.2 Predened Security Congurations . . . . . . . . . . . . . . . . . 116

8.3 Password Settings . . . . . . . . . . . . . . . . . . . . . . . . 117

8.4 BootSettings.......................... 118

8.5 LoginSettings.......................... 118

8.6 UserAddition.......................... 119

8.7 Miscellaneous Settings . . . . . . . . . . . . . . . . . . . . . . 119

9PolicyKit 121

9.1 Available Policies and Supported Applications . . . . . . . . . . . . 121

9.2 Authorization Types . . . . . . . . . . . . . . . . . . . . . . . 122

9.3 Modifying and Setting Privileges . . . . . . . . . . . . . . . . . . 123

10 Access Control Lists in Linux 131

10.1 Traditional File Permissions . . . . . . . . . . . . . . . . . . . . 131

10.2 Advantages of ACLs . . . . . . . . . . . . . . . . . . . . . . . 133

10.3 Denitions........................... 133

10.4 HandlingACLs.......................... 134

10.5 ACL Support in Applications . . . . . . . . . . . . . . . . . . . . 142

10.6 For More Information . . . . . . . . . . . . . . . . . . . . . . 143

11 Encrypting Partitions and Files 145

11.1 Setting Up an Encrypted File System with YaST . . . . . . . . . . . . 146

11.2 Using Encrypted Home Directories . . . . . . . . . . . . . . . . . 149

11.3 Using vi to Encrypt Single ASCII Text Files . . . . . . . . . . . . . . 150

12 Certicate Store 151

12.1 Activating Certicate Store . . . . . . . . . . . . . . . . . . . . 151

12.2 Importing Certicates . . . . . . . . . . . . . . . . . . . . . . 152

13 Intrusion Detection with AIDE 153

13.1 Setting Up a AIDE Database . . . . . . . . . . . . . . . . . . . . 153

13.2 Local AIDE Checks . . . . . . . . . . . . . . . . . . . . . . . . 156

13.3 System Independent Checking . . . . . . . . . . . . . . . . . . . 157

13.4 For More Information . . . . . . . . . . . . . . . . . . . . . . 158

Part III Network Security 159

14 SSH: Secure Network Operations 161

14.1 The OpenSSH Package . . . . . . . . . . . . . . . . . . . . . . 161

14.2 ThesshProgram......................... 162

14.3 scp—SecureCopy........................ 162

14.4 sftp—Secure File Transfer . . . . . . . . . . . . . . . . . . . . . 163

14.5 The SSH Daemon (sshd)—Server-Side . . . . . . . . . . . . . . . . 163

14.6 SSH Authentication Mechanisms . . . . . . . . . . . . . . . . . . 164

14.7 X, Authentication, and Forwarding Mechanisms . . . . . . . . . . . . 166

14.8 Conguring An SSH Daemon with YaST . . . . . . . . . . . . . . . 167

15 Masquerading and Firewalls 169

15.1 Packet Filtering with iptables . . . . . . . . . . . . . . . . . . . . 169

15.2 Masquerading Basics . . . . . . . . . . . . . . . . . . . . . . . 172

15.3 Firewalling Basics . . . . . . . . . . . . . . . . . . . . . . . . 173

15.4 SuSErewall2.......................... 174

15.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 179

16 Conguring VPN Server 181

16.1 Overview............................ 181

16.2 Creating the Simplest VPN Example . . . . . . . . . . . . . . . . . 185

16.3 Setting Up Your VPN Server Using Certicate Authority . . . . . . . . 187

16.4 KDE- and GNOME Applets For Clients . . . . . . . . . . . . . . . . 193

16.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 195

17 Managing X.509 Certication 197

17.1 The Principles of Digital Certication . . . . . . . . . . . . . . . . 197

17.2 YaST Modules for CA Management . . . . . . . . . . . . . . . . . 202

Part IV Conning Privileges with Novell AppArmor 215

18 Introducing AppArmor 217

18.1 Background Information on AppArmor Proling . . . . . . . . . . . 218

19 Getting Started 219

19.1 Installing Novell AppArmor . . . . . . . . . . . . . . . . . . . . 220

19.2 Enabling and Disabling Novell AppArmor . . . . . . . . . . . . . . 220

19.3 Choosing the Applications to Prole . . . . . . . . . . . . . . . . 221

19.4 Building and Modifying Proles . . . . . . . . . . . . . . . . . . 222

19.5 Conguring Novell AppArmor Event Notication and Reports . . . . . 224

19.6 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . 226

20 Immunizing Programs 227

20.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . 228

20.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . 230

20.3 Immunizing cron Jobs . . . . . . . . . . . . . . . . . . . . . . . 231

20.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . 232

21 Prole Components and Syntax 237

21.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 238

21.2 ProleTypes.......................... 241

21.3 #include Statements . . . . . . . . . . . . . . . . . . . . . . . 244

21.4 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 245

21.5 Network Access Control . . . . . . . . . . . . . . . . . . . . . 245

21.6 Paths and Globbing . . . . . . . . . . . . . . . . . . . . . . . 246

21.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . 249

21.8 ExecuteModes......................... 252

21.9 Resource Limit Control . . . . . . . . . . . . . . . . . . . . . . 257

21.10AuditingRules.......................... 258

21.11 Setting Capabilities per Prole . . . . . . . . . . . . . . . . . . . 259

22 AppArmor Prole Repositories 261

22.1 Using the Local Repository . . . . . . . . . . . . . . . . . . . . 261

22.2 Using the External Repository . . . . . . . . . . . . . . . . . . . 262

23 Building and Managing Proles with YaST 265

23.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . 267

23.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 275

23.3 EditingProles ......................... 275

23.4 Deleting a Prole . . . . . . . . . . . . . . . . . . . . . . . . 281

23.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . 281

23.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 283

24 Building Proles from the Command Line 287

24.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 287

24.2 Building AppArmor Proles . . . . . . . . . . . . . . . . . . . . 289

24.3 Adding or Creating an AppArmor Prole . . . . . . . . . . . . . . 290

24.4 Editing an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 290

24.5 Deleting an AppArmor Prole . . . . . . . . . . . . . . . . . . . 290

24.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . 291

24.7 Important Filenames and Directories . . . . . . . . . . . . . . . . 312

25 Proling Your Web Applications Using ChangeHat 315

25.1 Apache ChangeHat . . . . . . . . . . . . . . . . . . . . . . . . 316

25.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 322

26 Conning Users with pam_apparmor 327

27 Managing Proled Applications 329

27.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . 329

27.2 Conguring Security Event Notication . . . . . . . . . . . . . . . 330

27.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . 333

27.4 Conguring and Using the AppArmor Desktop Monitor Applet . . . . . 353

27.5 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 354

27.6 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 354

28 Support 357

28.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 357

28.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 357

28.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 359

28.4 Troubleshooting......................... 360

28.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 367

29 AppArmor Glossary 369

Part V The Linux Audit Framework 373

30 Understanding Linux Audit 375

30.1 Introducing the Components of Linux Audit . . . . . . . . . . . . . 378

30.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 379

30.3 Controlling the Audit System Using auditctl . . . . . . . . . . . . . 385

30.4 Passing Parameters to the Audit System . . . . . . . . . . . . . . . 387

30.5 Understanding the Audit Logs and Generating Reports . . . . . . . . . 391

30.6 Querying the Audit Daemon Logs with ausearch . . . . . . . . . . . 403

30.7 Analyzing Processes with autrace . . . . . . . . . . . . . . . . . . 407

30.8 Visualizing Audit Data . . . . . . . . . . . . . . . . . . . . . . 408

31 Setting Up the Linux Audit Framework 411

31.1 Determining the Components to Audit . . . . . . . . . . . . . . . 412

31.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 413

31.3 Enabling Audit for System Calls . . . . . . . . . . . . . . . . . . 414

31.4 Setting Up Audit Rules . . . . . . . . . . . . . . . . . . . . . . 415

31.5 Conguring Audit Reports . . . . . . . . . . . . . . . . . . . . . 417

31.6 Conguring Log Visualization . . . . . . . . . . . . . . . . . . . 420

32 Introducing an Audit Rule Set 423

32.1 Adding Basic Audit Conguration Parameters . . . . . . . . . . . . 424

32.2 Adding Watches on Audit Log Files and Conguration Files . . . . . . . 425

32.3 Monitoring File System Objects . . . . . . . . . . . . . . . . . . 426

32.4 Monitoring Security Conguration Files and Databases . . . . . . . . . 427

32.5 Monitoring Miscellaneous System Calls . . . . . . . . . . . . . . . 430

32.6 Filtering System Call Arguments . . . . . . . . . . . . . . . . . . 430

32.7 Managing Audit Event Records Using Keys . . . . . . . . . . . . . . 433

33 Useful Resources 435

Other manuals for LINUX ENTERPRISE DESKTOP 11

This manual suits for next models

Table of contents

Other Novell Software manuals

Novell

Novell ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE... User manual

Novell

Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT User manual

Novell

Novell OPEN ENTERPRISE SERVER 2 SP 2 - CLUSTER SERVICES 1.8.7 FOR... User manual

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell APPARMOR 1.2 - QUICK GUIDE AND Datasheet

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 2 User manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT User manual

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Technical manual

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Instruction Manual

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service manual

Novell

Novell APPARMOR - AND Datasheet

Novell

Novell GROUPWISE 7 - SECURITY POLICIES User manual

Novell

Novell CLIENT FOR LINUX 1.1 Instruction Manual

Novell

Novell QUICKBOOKS - INSTALL User manual

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION User manual

Novell

Novell SP2 - S Instruction Manual

Novell

Novell GROUPWISE 8 - DISTRIBUTION LISTS User manual

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Instruction Manual

Novell

Novell ACCESS MANAGER 3.1 SP1 - SSL VPN SERVER GUIDE... User manual

Novell

Novell GROUPWISE 7 ASYNC GATEWAY - INSTALLATION AND... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... User manual

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.3 - S Instruction Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide