Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... User manual

SUSE Linux Enterprise
Desktop
www.novell.com11
March17,2009 Security Guide

Security Guide
All content is copyright © 2006- 2009 Novell, Inc.
Legal Notice
This manual is protected under Novell intellectual property rights. By reproducing, duplicating or
distributing this manual you explicitly agree to conform to the terms and conditions of this license
agreement.
This manual may be freely reproduced, duplicated and distributed either as such or as part of a bundled
package in electronic and/or printed format, provided however that the following conditions are ful-
lled:
That this copyright notice and the names of authors and contributors appear clearly and distinctively
on all reproduced, duplicated and distributed copies. That this manual, specically for the printed
format, is reproduced and/or distributed for noncommercial use only. The express authorization of
Novell, Inc must be obtained prior to any other use of any manual or part thereof.
For Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell
.com/company/legal/trademarks/tmlist.html. * Linux is a registered trademark of
Linus Torvalds. All other third party trademarks are the property of their respective owners. A trademark
symbol (®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes a third party trademark.
All information found in this book has been compiled with utmost attention to detail. However, this
does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,
nor the translators shall be held liable for possible errors or the consequences thereof.

Contents
About This Guide ix
1Security and Condentiality 1
1.1 Local Security and Network Security . . . . . . . . . . . . . . . . . 2
1.2 Some General Security Tips and Tricks . . . . . . . . . . . . . . . . 11
1.3 Using the Central Security Reporting Address . . . . . . . . . . . . . 14
Part I Authentication 15
2Authentication with PAM 17
2.1 Structure of a PAM Conguration File . . . . . . . . . . . . . . . . 18
2.2 The PAM Conguration of sshd . . . . . . . . . . . . . . . . . . . 20
2.3 Conguration of PAM Modules . . . . . . . . . . . . . . . . . . . 22
2.4 Conguring PAM Using pam-cong . . . . . . . . . . . . . . . . . 24
2.5 For More Information . . . . . . . . . . . . . . . . . . . . . . . 26
3Using NIS 27
3.1 Conguring NIS Clients . . . . . . . . . . . . . . . . . . . . . . 27
4LDAP—A Directory Service 29
4.1 LDAPversusNIS......................... 30
4.2 Structure of an LDAP Directory Tree . . . . . . . . . . . . . . . . . 31
4.3 Conguring an LDAP Client with YaST . . . . . . . . . . . . . . . . 34
4.4 Conguring LDAP Users and Groups in YaST . . . . . . . . . . . . . . 42
4.5 Browsing the LDAP Directory Tree . . . . . . . . . . . . . . . . . . 44
4.6 For More Information . . . . . . . . . . . . . . . . . . . . . . . 45

5Active Directory Support 47
5.1 Integrating Linux and AD Environments . . . . . . . . . . . . . . . . 47
5.2 Background Information for Linux AD Support . . . . . . . . . . . . 48
5.3 Conguring a Linux Client for Active Directory . . . . . . . . . . . . 54
5.4 Logging In to an AD Domain . . . . . . . . . . . . . . . . . . . . 57
5.5 Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . . 59
6Network Authentication with Kerberos 61
6.1 Kerberos Terminology . . . . . . . . . . . . . . . . . . . . . . . 62
6.2 How Kerberos Works . . . . . . . . . . . . . . . . . . . . . . . 63
6.3 Users' View of Kerberos . . . . . . . . . . . . . . . . . . . . . . 66
6.4 For More Information . . . . . . . . . . . . . . . . . . . . . . . 67
7Using the Fingerprint Reader 69
7.1 Supported Applications and Actions . . . . . . . . . . . . . . . . . 69
7.2 Managing Fingerprints with YaST . . . . . . . . . . . . . . . . . . 70
Part II Local Security 73
8Conguring Security Settings with YaST 75
8.1 Security Overview ......................... 75
8.2 Predened Security Congurations ................. 76
8.3 Password Settings ........................ 77
8.4 BootSettings........................... 78
8.5 LoginSettings.......................... 78
8.6 UserAddition.......................... 79
8.7 Miscellaneous Settings . . . . . . . . . . . . . . . . . . . . . . . 79
9PolicyKit 81
9.1 Available Policies and Supported Applications . . . . . . . . . . . . . 81
9.2 Authorization Types . . . . . . . . . . . . . . . . . . . . . . . . 82
9.3 Modifying and Setting Privileges . . . . . . . . . . . . . . . . . . . 84
10 Access Control Lists in Linux 93
10.1 Traditional File Permissions . . . . . . . . . . . . . . . . . . . . . 93
10.2 Advantages of ACLs . . . . . . . . . . . . . . . . . . . . . . . . 95
10.3 Denitions............................ 95
10.4 HandlingACLs.......................... 96
10.5 ACL Support in Applications . . . . . . . . . . . . . . . . . . . . 104

10.6 For More Information . . . . . . . . . . . . . . . . . . . . . . 105
11 Encrypting Partitions and Files 107
11.1 Setting Up an Encrypted File System with YaST . . . . . . . . . . . . 108
11.2 Using Encrypted Home Directories . . . . . . . . . . . . . . . . . 111
11.3 Using vi to Encrypt Single ASCII Text Files . . . . . . . . . . . . . . 112
12 Certicate Store 113
12.1 Activating Certicate Store . . . . . . . . . . . . . . . . . . . . 113
12.2 Importing Certicates . . . . . . . . . . . . . . . . . . . . . . 114
13 Intrusion Detection with AIDE 115
13.1 Setting Up a AIDE Database . . . . . . . . . . . . . . . . . . . . 115
13.2 Local AIDE Checks . . . . . . . . . . . . . . . . . . . . . . . . 118
13.3 System Independent Checking . . . . . . . . . . . . . . . . . . . 119
13.4 For More Information . . . . . . . . . . . . . . . . . . . . . . 120
Part III Network Security 121
14 SSH: Secure Network Operations 123
14.1 The OpenSSH Package . . . . . . . . . . . . . . . . . . . . . . 123
14.2 ThesshProgram......................... 124
14.3 scp—SecureCopy........................ 124
14.4 sftp—Secure File Transfer . . . . . . . . . . . . . . . . . . . . . 125
14.5 The SSH Daemon (sshd)—Server-Side . . . . . . . . . . . . . . . . 125
14.6 SSH Authentication Mechanisms . . . . . . . . . . . . . . . . . . 126
14.7 X, Authentication, and Forwarding Mechanisms . . . . . . . . . . . . 128
14.8 Conguring An SSH Daemon with YaST . . . . . . . . . . . . . . . 129
15 Masquerading and Firewalls 131
15.1 Packet Filtering with iptables . . . . . . . . . . . . . . . . . . . . 131
15.2 Masquerading Basics . . . . . . . . . . . . . . . . . . . . . . . 134
15.3 Firewalling Basics . . . . . . . . . . . . . . . . . . . . . . . . 135
15.4 SuSErewall2.......................... 136
15.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 141
16 Conguring VPN Server 143
16.1 Overview............................ 143

16.2 Creating the Simplest VPN Example . . . . . . . . . . . . . . . . . 147
16.3 Setting Up Your VPN Server Using Certicate Authority . . . . . . . . 149
16.4 KDE- and GNOME Applets For Clients . . . . . . . . . . . . . . . . 155
16.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 157
17 Managing X.509 Certication 159
17.1 The Principles of Digital Certication . . . . . . . . . . . . . . . . 159
17.2 YaST Modules for CA Management . . . . . . . . . . . . . . . . . 163
Part IV Conning Privileges with Novell AppArmor 175
18 Introducing AppArmor 177
18.1 Background Information on AppArmor Proling . . . . . . . . . . . 178
19 Getting Started 179
19.1 Installing Novell AppArmor . . . . . . . . . . . . . . . . . . . . 180
19.2 Enabling and Disabling Novell AppArmor . . . . . . . . . . . . . . 180
19.3 Choosing the Applications to Prole . . . . . . . . . . . . . . . . 181
19.4 Building and Modifying Proles . . . . . . . . . . . . . . . . . . 182
19.5 Conguring Novell AppArmor Event Notication and Reports . . . . . 184
19.6 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . 186
20 Immunizing Programs 187
20.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . 188
20.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . 190
20.3 Immunizing cron Jobs . . . . . . . . . . . . . . . . . . . . . . . 191
20.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . 192
21 Prole Components and Syntax 197
21.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 198
21.2 ProleTypes.......................... 201
21.3 #include Statements...................... 204
21.4 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 205
21.5 Network Access Control . . . . . . . . . . . . . . . . . . . . . 205
21.6 Paths and Globbing . . . . . . . . . . . . . . . . . . . . . . . 206
21.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . 209
21.8 ExecuteModes......................... 212
21.9 Resource Limit Control . . . . . . . . . . . . . . . . . . . . . . 217
21.10AuditingRules.......................... 218

21.11 Setting Capabilities per Prole . . . . . . . . . . . . . . . . . . . 219
22 AppArmor Prole Repositories 221
22.1 Using the Local Repository . . . . . . . . . . . . . . . . . . . . 221
22.2 Using the External Repository . . . . . . . . . . . . . . . . . . . 222
23 Building and Managing Proles with YaST 225
23.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . 227
23.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 235
23.3 EditingProles ......................... 235
23.4 Deleting a Prole . . . . . . . . . . . . . . . . . . . . . . . . 241
23.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . 241
23.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 243
24 Building Proles from the Command Line 247
24.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 247
24.2 Building AppArmor Proles . . . . . . . . . . . . . . . . . . . . 249
24.3 Adding or Creating an AppArmor Prole . . . . . . . . . . . . . . 250
24.4 Editing an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 250
24.5 Deleting an AppArmor Prole . . . . . . . . . . . . . . . . . . . 250
24.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . 251
24.7 Important Filenames and Directories . . . . . . . . . . . . . . . . 272
25 Proling Your Web Applications Using ChangeHat 275
25.1 Apache ChangeHat . . . . . . . . . . . . . . . . . . . . . . . . 276
25.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 282
26 Conning Users with pam_apparmor 287
27 Managing Proled Applications 289
27.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . 289
27.2 Conguring Security Event Notication . . . . . . . . . . . . . . . 290
27.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . 293
27.4 Conguring and Using the AppArmor Desktop Monitor Applet . . . . . 313
27.5 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 314
27.6 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 314

28 Support 317
28.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 317
28.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 317
28.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 319
28.4 Troubleshooting......................... 320
28.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 327
29 AppArmor Glossary 329
Part V The Linux Audit Framework 333
30 Understanding Linux Audit 335
30.1 Introducing the Components of Linux Audit . . . . . . . . . . . . . 338
30.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 339
30.3 Controlling the Audit System Using auditctl . . . . . . . . . . . . . 345
30.4 Passing Parameters to the Audit System . . . . . . . . . . . . . . . 347
30.5 Understanding the Audit Logs and Generating Reports . . . . . . . . . 351
30.6 Querying the Audit Daemon Logs with ausearch . . . . . . . . . . . 363
30.7 Analyzing Processes with autrace . . . . . . . . . . . . . . . . . . 367
30.8 Visualizing Audit Data . . . . . . . . . . . . . . . . . . . . . . 368
31 Setting Up the Linux Audit Framework 371
31.1 Determining the Components to Audit . . . . . . . . . . . . . . . 372
31.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 373
31.3 Enabling Audit for System Calls . . . . . . . . . . . . . . . . . . 374
31.4 Setting Up Audit Rules . . . . . . . . . . . . . . . . . . . . . . 375
31.5 Conguring Audit Reports . . . . . . . . . . . . . . . . . . . . . 377
31.6 Conguring Log Visualization . . . . . . . . . . . . . . . . . . . 380
32 Introducing an Audit Rule Set 383
32.1 Adding Basic Audit Conguration Parameters . . . . . . . . . . . . 384
32.2 Adding Watches on Audit Log Files and Conguration Files . . . . . . . 385
32.3 Monitoring File System Objects . . . . . . . . . . . . . . . . . . 386
32.4 Monitoring Security Conguration Files and Databases . . . . . . . . . 387
32.5 Monitoring Miscellaneous System Calls . . . . . . . . . . . . . . . 390
32.6 Filtering System Call Arguments . . . . . . . . . . . . . . . . . . 390
32.7 Managing Audit Event Records Using Keys . . . . . . . . . . . . . . 393
33 Useful Resources 395

About This Guide
This manual introduces the basic concepts of system security on SUSE Linux Enterprise
Desktop. It covers extensive documentation about authentication mechanisms available
on Linux, such as NIS or LDAP. It also deals with aspects of local security like access
control lists, encryption and intrusion detection. In the network security part you learn
how to secure your computers with a rewall and masquerading and how to set up
virtual private networks (VPN). This manual also shows how to make use of the product
inherent security software like Novell AppArmor (which lets you specify per program
which les the program may read, write, and execute) or the auditing system that reliably
collects information about any security-relevant events.
Many chapters in this manual contain links to additional documentation resources. This
includes additional documentation that is available on the system as well as documen-
tation available on the Internet.
For an overview of the documentation available for your product and the latest docu-
mentation updates, refer to http://www.novell.com/documentation or to
the following section.
1 Available Documentation
We provide HTML and PDF versions of our books in different languages. The following
manuals for users and administrators are available on this product:
GNOME User Guide (↑GNOME User Guide)
Introduces the GNOME desktop of SUSE Linux Enterprise Desktop. It guides you
through using and conguring the desktop and helps you perform key tasks. It is
intended mainly for end users who want to make efcient use of GNOME desktop
as their default desktop.
Application Guide (↑Application Guide)
Learn how to use and congure key desktop applications on SUSE Linux Enterprise
Desktop. This guide introduces browsers and e-mail clients as well as ofce appli-
cations and collaboration tools. It also covers graphics and multimedia applications.

Deployment Guide (↑Deployment Guide)
Shows how to install single or multiple systems and how to exploit the product
inherent capabilities for a deployment infrastructure. Choose from various approach-
es, ranging from a local installation or a network installation server to a mass de-
ployment using a remote-controlled, highly-customized, and automated installation
technique.
Administration Guide (↑Administration Guide)
Covers system administration tasks like maintaining, monitoring and customizing
an initially installed system.
Security Guide (page 1)
Introduces basic concepts of system security, covering both local and network se-
curity aspects. Shows how to make use of the product inherent security software
like Novell AppArmor (which lets you specify per program which les the program
may read, write, and execute) or the auditing system that reliably collects informa-
tion about any security-relevant events.
System Analysis and Tuning Guide (↑System Analysis and Tuning Guide)
An administrator's guide for problem detection, resolution and optimization. Find
how to inspect and optimize your system by means of monitoring tools and how
to efciently manage resources. Also contains an overview of common problems
and solutions and of additional help and documentation resources.
Virtualization with Xen (↑Virtualization with Xen)
Offers an introduction to virtualization technology of your product. It features an
overview of the various elds of application and installation types of each of the
platforms supported by SUSE Linux Enterprise Server as well as a short description
of the installation procedure.
In addition to the comprehensive manuals, several quick start guides are available:
Installation Quick Start (↑Installation Quick Start)
Lists the system requirements and guides you step-by-step through the installation
of SUSE Linux Enterprise Desktop from DVD, or from an ISO image.
Linux Audit Quick Start
Gives a short overview how to enable and congure the auditing system and how
to execute key tasks such as setting up audit rules, generating reports, and analyzing
the log les.
xSecurity Guide