Novell LINUX ENTERPRISE DESKTOP 11 User manual

SUSE Linux Enterprise
Server
www.novell.com11
March17,2009 Security Guide

Security Guide
All content is copyright © 2006- 2009 Novell, Inc.
Legal Notice
This manual is protected under Novell intellectual property rights. By reproducing, duplicating or
distributing this manual you explicitly agree to conform to the terms and conditions of this license
agreement.
This manual may be freely reproduced, duplicated and distributed either as such or as part of a bundled
package in electronic and/or printed format, provided however that the following conditions are ful-
lled:
That this copyright notice and the names of authors and contributors appear clearly and distinctively
on all reproduced, duplicated and distributed copies. That this manual, specically for the printed
format, is reproduced and/or distributed for noncommercial use only. The express authorization of
Novell, Inc must be obtained prior to any other use of any manual or part thereof.
For Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell
.com/company/legal/trademarks/tmlist.html. * Linux is a registered trademark of
Linus Torvalds. All other third party trademarks are the property of their respective owners. A trademark
symbol (®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes a third party trademark.
All information found in this book has been compiled with utmost attention to detail. However, this
does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,
nor the translators shall be held liable for possible errors or the consequences thereof.

Contents
About This Guide xi
1Security and Condentiality 1
1.1 Local Security and Network Security . . . . . . . . . . . . . . . . . 2
1.2 Some General Security Tips and Tricks . . . . . . . . . . . . . . . . 11
1.3 Using the Central Security Reporting Address . . . . . . . . . . . . . 14
Part I Authentication 15
2Authentication with PAM 17
2.1 Structure of a PAM Conguration File . . . . . . . . . . . . . . . . 18
2.2 The PAM Conguration of sshd . . . . . . . . . . . . . . . . . . . 20
2.3 Conguration of PAM Modules . . . . . . . . . . . . . . . . . . . 22
2.4 Conguring PAM Using pam-cong . . . . . . . . . . . . . . . . . 24
2.5 For More Information . . . . . . . . . . . . . . . . . . . . . . . 26
3Using NIS 27
3.1 Conguring NIS Servers . . . . . . . . . . . . . . . . . . . . . . 27
3.2 Conguring NIS Clients . . . . . . . . . . . . . . . . . . . . . . 33
4LDAP—A Directory Service 35
4.1 LDAPversusNIS......................... 36
4.2 Structure of an LDAP Directory Tree . . . . . . . . . . . . . . . . . 37
4.3 Conguring an LDAP Server with YaST . . . . . . . . . . . . . . . . 40
4.4 Conguring an LDAP Client with YaST . . . . . . . . . . . . . . . . 49
4.5 Conguring LDAP Users and Groups in YaST . . . . . . . . . . . . . . 57

4.6 Browsing the LDAP Directory Tree . . . . . . . . . . . . . . . . . . 59
4.7 Manually Conguring an LDAP Server . . . . . . . . . . . . . . . . 60
4.8 Manually Administering LDAP Data . . . . . . . . . . . . . . . . . 61
4.9 For More Information . . . . . . . . . . . . . . . . . . . . . . . 65
5Active Directory Support 67
5.1 Integrating Linux and AD Environments . . . . . . . . . . . . . . . . 67
5.2 Background Information for Linux AD Support . . . . . . . . . . . . 68
5.3 Conguring a Linux Client for Active Directory . . . . . . . . . . . . 74
5.4 Logging In to an AD Domain . . . . . . . . . . . . . . . . . . . . 77
5.5 Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . . 79
6Network Authentication with Kerberos 81
6.1 Kerberos Terminology . . . . . . . . . . . . . . . . . . . . . . . 82
6.2 How Kerberos Works . . . . . . . . . . . . . . . . . . . . . . . 83
6.3 Users' View of Kerberos . . . . . . . . . . . . . . . . . . . . . . 86
6.4 Installing and Administering Kerberos . . . . . . . . . . . . . . . . 87
6.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 108
7Using the Fingerprint Reader 109
7.1 Supported Applications and Actions . . . . . . . . . . . . . . . . 109
7.2 Managing Fingerprints with YaST . . . . . . . . . . . . . . . . . . 110
Part II Local Security 113
8Conguring Security Settings with YaST 115
8.1 Security Overview . . . . . . . . . . . . . . . . . . . . . . . . 115
8.2 Predened Security Congurations . . . . . . . . . . . . . . . . . 116
8.3 Password Settings . . . . . . . . . . . . . . . . . . . . . . . . 117
8.4 BootSettings.......................... 118
8.5 LoginSettings.......................... 118
8.6 UserAddition.......................... 119
8.7 Miscellaneous Settings . . . . . . . . . . . . . . . . . . . . . . 119
9PolicyKit 121
9.1 Available Policies and Supported Applications . . . . . . . . . . . . 121
9.2 Authorization Types . . . . . . . . . . . . . . . . . . . . . . . 122
9.3 Modifying and Setting Privileges . . . . . . . . . . . . . . . . . . 123

10 Access Control Lists in Linux 131
10.1 Traditional File Permissions . . . . . . . . . . . . . . . . . . . . 131
10.2 Advantages of ACLs . . . . . . . . . . . . . . . . . . . . . . . 133
10.3 Denitions........................... 133
10.4 HandlingACLs.......................... 134
10.5 ACL Support in Applications . . . . . . . . . . . . . . . . . . . . 142
10.6 For More Information . . . . . . . . . . . . . . . . . . . . . . 143
11 Encrypting Partitions and Files 145
11.1 Setting Up an Encrypted File System with YaST . . . . . . . . . . . . 146
11.2 Using Encrypted Home Directories . . . . . . . . . . . . . . . . . 149
11.3 Using vi to Encrypt Single ASCII Text Files . . . . . . . . . . . . . . 150
12 Certicate Store 151
12.1 Activating Certicate Store . . . . . . . . . . . . . . . . . . . . 151
12.2 Importing Certicates . . . . . . . . . . . . . . . . . . . . . . 152
13 Intrusion Detection with AIDE 153
13.1 Setting Up a AIDE Database . . . . . . . . . . . . . . . . . . . . 153
13.2 Local AIDE Checks . . . . . . . . . . . . . . . . . . . . . . . . 156
13.3 System Independent Checking . . . . . . . . . . . . . . . . . . . 157
13.4 For More Information . . . . . . . . . . . . . . . . . . . . . . 158
Part III Network Security 159
14 SSH: Secure Network Operations 161
14.1 The OpenSSH Package . . . . . . . . . . . . . . . . . . . . . . 161
14.2 ThesshProgram......................... 162
14.3 scp—SecureCopy........................ 162
14.4 sftp—Secure File Transfer . . . . . . . . . . . . . . . . . . . . . 163
14.5 The SSH Daemon (sshd)—Server-Side . . . . . . . . . . . . . . . . 163
14.6 SSH Authentication Mechanisms . . . . . . . . . . . . . . . . . . 164
14.7 X, Authentication, and Forwarding Mechanisms . . . . . . . . . . . . 166
14.8 Conguring An SSH Daemon with YaST . . . . . . . . . . . . . . . 167
15 Masquerading and Firewalls 169
15.1 Packet Filtering with iptables . . . . . . . . . . . . . . . . . . . . 169
15.2 Masquerading Basics . . . . . . . . . . . . . . . . . . . . . . . 172
15.3 Firewalling Basics . . . . . . . . . . . . . . . . . . . . . . . . 173

15.4 SuSErewall2.......................... 174
15.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 179
16 Conguring VPN Server 181
16.1 Overview............................ 181
16.2 Creating the Simplest VPN Example . . . . . . . . . . . . . . . . . 185
16.3 Setting Up Your VPN Server Using Certicate Authority . . . . . . . . 187
16.4 KDE- and GNOME Applets For Clients . . . . . . . . . . . . . . . . 193
16.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 195
17 Managing X.509 Certication 197
17.1 The Principles of Digital Certication . . . . . . . . . . . . . . . . 197
17.2 YaST Modules for CA Management . . . . . . . . . . . . . . . . . 202
Part IV Conning Privileges with Novell AppArmor 215
18 Introducing AppArmor 217
18.1 Background Information on AppArmor Proling . . . . . . . . . . . 218
19 Getting Started 219
19.1 Installing Novell AppArmor . . . . . . . . . . . . . . . . . . . . 220
19.2 Enabling and Disabling Novell AppArmor . . . . . . . . . . . . . . 220
19.3 Choosing the Applications to Prole . . . . . . . . . . . . . . . . 221
19.4 Building and Modifying Proles . . . . . . . . . . . . . . . . . . 222
19.5 Conguring Novell AppArmor Event Notication and Reports . . . . . 224
19.6 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . 226
20 Immunizing Programs 227
20.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . 228
20.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . 230
20.3 Immunizing cron Jobs . . . . . . . . . . . . . . . . . . . . . . . 231
20.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . 232
21 Prole Components and Syntax 237
21.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 238
21.2 ProleTypes.......................... 241
21.3 #include Statements . . . . . . . . . . . . . . . . . . . . . . . 244
21.4 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 245

21.5 Network Access Control . . . . . . . . . . . . . . . . . . . . . 245
21.6 Paths and Globbing . . . . . . . . . . . . . . . . . . . . . . . 246
21.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . 249
21.8 ExecuteModes......................... 252
21.9 Resource Limit Control . . . . . . . . . . . . . . . . . . . . . . 257
21.10AuditingRules.......................... 258
21.11 Setting Capabilities per Prole . . . . . . . . . . . . . . . . . . . 259
22 AppArmor Prole Repositories 261
22.1 Using the Local Repository . . . . . . . . . . . . . . . . . . . . 261
22.2 Using the External Repository . . . . . . . . . . . . . . . . . . . 262
23 Building and Managing Proles with YaST 265
23.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . 267
23.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 275
23.3 EditingProles ......................... 275
23.4 Deleting a Prole . . . . . . . . . . . . . . . . . . . . . . . . 281
23.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . 281
23.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 283
24 Building Proles from the Command Line 287
24.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 287
24.2 Building AppArmor Proles . . . . . . . . . . . . . . . . . . . . 289
24.3 Adding or Creating an AppArmor Prole . . . . . . . . . . . . . . 290
24.4 Editing an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 290
24.5 Deleting an AppArmor Prole . . . . . . . . . . . . . . . . . . . 290
24.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . 291
24.7 Important Filenames and Directories . . . . . . . . . . . . . . . . 312
25 Proling Your Web Applications Using ChangeHat 315
25.1 Apache ChangeHat . . . . . . . . . . . . . . . . . . . . . . . . 316
25.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 322
26 Conning Users with pam_apparmor 327
27 Managing Proled Applications 329
27.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . 329
27.2 Conguring Security Event Notication . . . . . . . . . . . . . . . 330
27.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . 333

27.4 Conguring and Using the AppArmor Desktop Monitor Applet . . . . . 353
27.5 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 354
27.6 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 354
28 Support 357
28.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 357
28.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 357
28.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 359
28.4 Troubleshooting......................... 360
28.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 367
29 AppArmor Glossary 369
Part V The Linux Audit Framework 373
30 Understanding Linux Audit 375
30.1 Introducing the Components of Linux Audit . . . . . . . . . . . . . 378
30.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 379
30.3 Controlling the Audit System Using auditctl . . . . . . . . . . . . . 385
30.4 Passing Parameters to the Audit System . . . . . . . . . . . . . . . 387
30.5 Understanding the Audit Logs and Generating Reports . . . . . . . . . 391
30.6 Querying the Audit Daemon Logs with ausearch . . . . . . . . . . . 403
30.7 Analyzing Processes with autrace . . . . . . . . . . . . . . . . . . 407
30.8 Visualizing Audit Data . . . . . . . . . . . . . . . . . . . . . . 408
31 Setting Up the Linux Audit Framework 411
31.1 Determining the Components to Audit . . . . . . . . . . . . . . . 412
31.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 413
31.3 Enabling Audit for System Calls . . . . . . . . . . . . . . . . . . 414
31.4 Setting Up Audit Rules . . . . . . . . . . . . . . . . . . . . . . 415
31.5 Conguring Audit Reports . . . . . . . . . . . . . . . . . . . . . 417
31.6 Conguring Log Visualization . . . . . . . . . . . . . . . . . . . 420
32 Introducing an Audit Rule Set 423
32.1 Adding Basic Audit Conguration Parameters . . . . . . . . . . . . 424
32.2 Adding Watches on Audit Log Files and Conguration Files . . . . . . . 425
32.3 Monitoring File System Objects . . . . . . . . . . . . . . . . . . 426
32.4 Monitoring Security Conguration Files and Databases . . . . . . . . . 427
32.5 Monitoring Miscellaneous System Calls . . . . . . . . . . . . . . . 430
32.6 Filtering System Call Arguments . . . . . . . . . . . . . . . . . . 430

32.7 Managing Audit Event Records Using Keys . . . . . . . . . . . . . . 433
33 Useful Resources 435