Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Manuel utilisateur

SUSE Linux Enterprise

Desktop

www.novell.com11

March17,2009 Security Guide

Security Guide

Legal Notice

This manual is protected under Novell intellectual property rights. By reproducing, duplicating or

distributing this manual you explicitly agree to conform to the terms and conditions of this license

agreement.

This manual may be freely reproduced, duplicated and distributed either as such or as part of a bundled

package in electronic and/or printed format, provided however that the following conditions are ful-

lled:

That this copyright notice and the names of authors and contributors appear clearly and distinctively

on all reproduced, duplicated and distributed copies. That this manual, specically for the printed

format, is reproduced and/or distributed for noncommercial use only. The express authorization of

Novell, Inc must be obtained prior to any other use of any manual or part thereof.

For Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell

.com/company/legal/trademarks/tmlist.html. * Linux is a registered trademark of

Linus Torvalds. All other third party trademarks are the property of their respective owners. A trademark

symbol (®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes a third party trademark.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,

nor the translators shall be held liable for possible errors or the consequences thereof.

Contents

About This Guide ix

1Security and Condentiality 1

1.1 Local Security and Network Security . . . . . . . . . . . . . . . . . 2

1.2 Some General Security Tips and Tricks . . . . . . . . . . . . . . . . 11

1.3 Using the Central Security Reporting Address . . . . . . . . . . . . . 14

Part I Authentication 15

2Authentication with PAM 17

2.1 Structure of a PAM Conguration File . . . . . . . . . . . . . . . . 18

2.2 The PAM Conguration of sshd . . . . . . . . . . . . . . . . . . . 20

2.3 Conguration of PAM Modules . . . . . . . . . . . . . . . . . . . 22

2.4 Conguring PAM Using pam-cong . . . . . . . . . . . . . . . . . 24

2.5 For More Information . . . . . . . . . . . . . . . . . . . . . . . 26

3Using NIS 27

3.1 Conguring NIS Clients . . . . . . . . . . . . . . . . . . . . . . 27

4LDAP—A Directory Service 29

4.1 LDAPversusNIS......................... 30

4.2 Structure of an LDAP Directory Tree . . . . . . . . . . . . . . . . . 31

4.3 Conguring an LDAP Client with YaST . . . . . . . . . . . . . . . . 34

4.4 Conguring LDAP Users and Groups in YaST . . . . . . . . . . . . . . 42

4.5 Browsing the LDAP Directory Tree . . . . . . . . . . . . . . . . . . 44

4.6 For More Information . . . . . . . . . . . . . . . . . . . . . . . 45

5Active Directory Support 47

5.1 Integrating Linux and AD Environments . . . . . . . . . . . . . . . . 47

5.2 Background Information for Linux AD Support . . . . . . . . . . . . 48

5.3 Conguring a Linux Client for Active Directory . . . . . . . . . . . . 54

5.4 Logging In to an AD Domain . . . . . . . . . . . . . . . . . . . . 57

5.5 Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . . 59

6Network Authentication with Kerberos 61

6.1 Kerberos Terminology . . . . . . . . . . . . . . . . . . . . . . . 62

6.2 How Kerberos Works . . . . . . . . . . . . . . . . . . . . . . . 63

6.3 Users' View of Kerberos . . . . . . . . . . . . . . . . . . . . . . 66

6.4 For More Information . . . . . . . . . . . . . . . . . . . . . . . 67

7Using the Fingerprint Reader 69

7.1 Supported Applications and Actions . . . . . . . . . . . . . . . . . 69

7.2 Managing Fingerprints with YaST . . . . . . . . . . . . . . . . . . 70

Part II Local Security 73

8Conguring Security Settings with YaST 75

8.1 Security Overview ......................... 75

8.2 Predened Security Congurations ................. 76

8.3 Password Settings ........................ 77

8.4 BootSettings........................... 78

8.5 LoginSettings.......................... 78

8.6 UserAddition.......................... 79

8.7 Miscellaneous Settings . . . . . . . . . . . . . . . . . . . . . . . 79

9PolicyKit 81

9.1 Available Policies and Supported Applications . . . . . . . . . . . . . 81

9.2 Authorization Types . . . . . . . . . . . . . . . . . . . . . . . . 82

9.3 Modifying and Setting Privileges . . . . . . . . . . . . . . . . . . . 84

10 Access Control Lists in Linux 93

10.1 Traditional File Permissions . . . . . . . . . . . . . . . . . . . . . 93

10.2 Advantages of ACLs . . . . . . . . . . . . . . . . . . . . . . . . 95

10.3 Denitions............................ 95

10.4 HandlingACLs.......................... 96

10.5 ACL Support in Applications . . . . . . . . . . . . . . . . . . . . 104

10.6 For More Information . . . . . . . . . . . . . . . . . . . . . . 105

11 Encrypting Partitions and Files 107

11.1 Setting Up an Encrypted File System with YaST . . . . . . . . . . . . 108

11.2 Using Encrypted Home Directories . . . . . . . . . . . . . . . . . 111

11.3 Using vi to Encrypt Single ASCII Text Files . . . . . . . . . . . . . . 112

12 Certicate Store 113

12.1 Activating Certicate Store . . . . . . . . . . . . . . . . . . . . 113

12.2 Importing Certicates . . . . . . . . . . . . . . . . . . . . . . 114

13 Intrusion Detection with AIDE 115

13.1 Setting Up a AIDE Database . . . . . . . . . . . . . . . . . . . . 115

13.2 Local AIDE Checks . . . . . . . . . . . . . . . . . . . . . . . . 118

13.3 System Independent Checking . . . . . . . . . . . . . . . . . . . 119

13.4 For More Information . . . . . . . . . . . . . . . . . . . . . . 120

Part III Network Security 121

14 SSH: Secure Network Operations 123

14.1 The OpenSSH Package . . . . . . . . . . . . . . . . . . . . . . 123

14.2 ThesshProgram......................... 124

14.3 scp—SecureCopy........................ 124

14.4 sftp—Secure File Transfer . . . . . . . . . . . . . . . . . . . . . 125

14.5 The SSH Daemon (sshd)—Server-Side . . . . . . . . . . . . . . . . 125

14.6 SSH Authentication Mechanisms . . . . . . . . . . . . . . . . . . 126

14.7 X, Authentication, and Forwarding Mechanisms . . . . . . . . . . . . 128

14.8 Conguring An SSH Daemon with YaST . . . . . . . . . . . . . . . 129

15 Masquerading and Firewalls 131

15.1 Packet Filtering with iptables . . . . . . . . . . . . . . . . . . . . 131

15.2 Masquerading Basics . . . . . . . . . . . . . . . . . . . . . . . 134

15.3 Firewalling Basics . . . . . . . . . . . . . . . . . . . . . . . . 135

15.4 SuSErewall2.......................... 136

15.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 141

16 Conguring VPN Server 143

16.1 Overview............................ 143

16.2 Creating the Simplest VPN Example . . . . . . . . . . . . . . . . . 147

16.3 Setting Up Your VPN Server Using Certicate Authority . . . . . . . . 149

16.4 KDE- and GNOME Applets For Clients . . . . . . . . . . . . . . . . 155

16.5 For More Information . . . . . . . . . . . . . . . . . . . . . . 157

17 Managing X.509 Certication 159

17.1 The Principles of Digital Certication . . . . . . . . . . . . . . . . 159

17.2 YaST Modules for CA Management . . . . . . . . . . . . . . . . . 163

Part IV Conning Privileges with Novell AppArmor 175

18 Introducing AppArmor 177

18.1 Background Information on AppArmor Proling . . . . . . . . . . . 178

19 Getting Started 179

19.1 Installing Novell AppArmor . . . . . . . . . . . . . . . . . . . . 180

19.2 Enabling and Disabling Novell AppArmor . . . . . . . . . . . . . . 180

19.3 Choosing the Applications to Prole . . . . . . . . . . . . . . . . 181

19.4 Building and Modifying Proles . . . . . . . . . . . . . . . . . . 182

19.5 Conguring Novell AppArmor Event Notication and Reports . . . . . 184

19.6 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . 186

20 Immunizing Programs 187

20.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . 188

20.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . 190

20.3 Immunizing cron Jobs . . . . . . . . . . . . . . . . . . . . . . . 191

20.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . 192

21 Prole Components and Syntax 197

21.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 198

21.2 ProleTypes.......................... 201

21.3 #include Statements...................... 204

21.4 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 205

21.5 Network Access Control . . . . . . . . . . . . . . . . . . . . . 205

21.6 Paths and Globbing . . . . . . . . . . . . . . . . . . . . . . . 206

21.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . 209

21.8 ExecuteModes......................... 212

21.9 Resource Limit Control . . . . . . . . . . . . . . . . . . . . . . 217

21.10AuditingRules.......................... 218

21.11 Setting Capabilities per Prole . . . . . . . . . . . . . . . . . . . 219

22 AppArmor Prole Repositories 221

22.1 Using the Local Repository . . . . . . . . . . . . . . . . . . . . 221

22.2 Using the External Repository . . . . . . . . . . . . . . . . . . . 222

23 Building and Managing Proles with YaST 225

23.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . 227

23.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 235

23.3 EditingProles ......................... 235

23.4 Deleting a Prole . . . . . . . . . . . . . . . . . . . . . . . . 241

23.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . 241

23.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 243

24 Building Proles from the Command Line 247

24.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 247

24.2 Building AppArmor Proles . . . . . . . . . . . . . . . . . . . . 249

24.3 Adding or Creating an AppArmor Prole . . . . . . . . . . . . . . 250

24.4 Editing an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 250

24.5 Deleting an AppArmor Prole . . . . . . . . . . . . . . . . . . . 250

24.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . 251

24.7 Important Filenames and Directories . . . . . . . . . . . . . . . . 272

25 Proling Your Web Applications Using ChangeHat 275

25.1 Apache ChangeHat . . . . . . . . . . . . . . . . . . . . . . . . 276

25.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 282

26 Conning Users with pam_apparmor 287

27 Managing Proled Applications 289

27.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . 289

27.2 Conguring Security Event Notication . . . . . . . . . . . . . . . 290

27.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . 293

27.4 Conguring and Using the AppArmor Desktop Monitor Applet . . . . . 313

27.5 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 314

27.6 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 314

28 Support 317

28.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 317

28.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 317

28.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 319

28.4 Troubleshooting......................... 320

28.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 327

29 AppArmor Glossary 329

Part V The Linux Audit Framework 333

30 Understanding Linux Audit 335

30.1 Introducing the Components of Linux Audit . . . . . . . . . . . . . 338

30.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 339

30.3 Controlling the Audit System Using auditctl . . . . . . . . . . . . . 345

30.4 Passing Parameters to the Audit System . . . . . . . . . . . . . . . 347

30.5 Understanding the Audit Logs and Generating Reports . . . . . . . . . 351

30.6 Querying the Audit Daemon Logs with ausearch . . . . . . . . . . . 363

30.7 Analyzing Processes with autrace . . . . . . . . . . . . . . . . . . 367

30.8 Visualizing Audit Data . . . . . . . . . . . . . . . . . . . . . . 368

31 Setting Up the Linux Audit Framework 371

31.1 Determining the Components to Audit . . . . . . . . . . . . . . . 372

31.2 Conguring the Audit Daemon . . . . . . . . . . . . . . . . . . . 373

31.3 Enabling Audit for System Calls . . . . . . . . . . . . . . . . . . 374

31.4 Setting Up Audit Rules . . . . . . . . . . . . . . . . . . . . . . 375

31.5 Conguring Audit Reports . . . . . . . . . . . . . . . . . . . . . 377

31.6 Conguring Log Visualization . . . . . . . . . . . . . . . . . . . 380

32 Introducing an Audit Rule Set 383

32.1 Adding Basic Audit Conguration Parameters . . . . . . . . . . . . 384

32.2 Adding Watches on Audit Log Files and Conguration Files . . . . . . . 385

32.3 Monitoring File System Objects . . . . . . . . . . . . . . . . . . 386

32.4 Monitoring Security Conguration Files and Databases . . . . . . . . . 387

32.5 Monitoring Miscellaneous System Calls . . . . . . . . . . . . . . . 390

32.6 Filtering System Call Arguments . . . . . . . . . . . . . . . . . . 390

32.7 Managing Audit Event Records Using Keys . . . . . . . . . . . . . . 393

33 Useful Resources 395

About This Guide

This manual introduces the basic concepts of system security on SUSE Linux Enterprise

Desktop. It covers extensive documentation about authentication mechanisms available

on Linux, such as NIS or LDAP. It also deals with aspects of local security like access

control lists, encryption and intrusion detection. In the network security part you learn

how to secure your computers with a rewall and masquerading and how to set up

virtual private networks (VPN). This manual also shows how to make use of the product

inherent security software like Novell AppArmor (which lets you specify per program

which les the program may read, write, and execute) or the auditing system that reliably

collects information about any security-relevant events.

Many chapters in this manual contain links to additional documentation resources. This

includes additional documentation that is available on the system as well as documen-

tation available on the Internet.

For an overview of the documentation available for your product and the latest docu-

mentation updates, refer to http://www.novell.com/documentation or to

the following section.

1 Available Documentation

We provide HTML and PDF versions of our books in different languages. The following

manuals for users and administrators are available on this product:

GNOME User Guide (↑GNOME User Guide)

Introduces the GNOME desktop of SUSE Linux Enterprise Desktop. It guides you

through using and conguring the desktop and helps you perform key tasks. It is

intended mainly for end users who want to make efcient use of GNOME desktop

as their default desktop.

Application Guide (↑Application Guide)

Learn how to use and congure key desktop applications on SUSE Linux Enterprise

Desktop. This guide introduces browsers and e-mail clients as well as ofce appli-

cations and collaboration tools. It also covers graphics and multimedia applications.

Deployment Guide (↑Deployment Guide)

Shows how to install single or multiple systems and how to exploit the product

inherent capabilities for a deployment infrastructure. Choose from various approach-

es, ranging from a local installation or a network installation server to a mass de-

ployment using a remote-controlled, highly-customized, and automated installation

technique.

Administration Guide (↑Administration Guide)

Covers system administration tasks like maintaining, monitoring and customizing

an initially installed system.

Security Guide (page 1)

Introduces basic concepts of system security, covering both local and network se-

curity aspects. Shows how to make use of the product inherent security software

like Novell AppArmor (which lets you specify per program which les the program

may read, write, and execute) or the auditing system that reliably collects informa-

tion about any security-relevant events.

System Analysis and Tuning Guide (↑System Analysis and Tuning Guide)

An administrator's guide for problem detection, resolution and optimization. Find

how to inspect and optimize your system by means of monitoring tools and how

to efciently manage resources. Also contains an overview of common problems

and solutions and of additional help and documentation resources.

Virtualization with Xen (↑Virtualization with Xen)

Offers an introduction to virtualization technology of your product. It features an

overview of the various elds of application and installation types of each of the

platforms supported by SUSE Linux Enterprise Server as well as a short description

of the installation procedure.

In addition to the comprehensive manuals, several quick start guides are available:

Installation Quick Start (↑Installation Quick Start)

Lists the system requirements and guides you step-by-step through the installation

of SUSE Linux Enterprise Desktop from DVD, or from an ISO image.

Linux Audit Quick Start

Gives a short overview how to enable and congure the auditing system and how

to execute key tasks such as setting up audit rules, generating reports, and analyzing

the log les.

xSecurity Guide

Autres manuels pour LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE...

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Novell Logiciel

Novell

Novell GROUPWISE 7 - POST OFFICES Manuel utilisateur

Novell

Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuel utilisateur

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Manuel utilisateur

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.1 -... Manuel utilisateur

Novell

Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Manuel de service

Novell

Novell POLICIES IN IMANAGER 3.6.1 - 06-05-2009 Manuel utilisateur

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Mode d’emploi

Novell

Novell LINUX ENTERPRISE 11 - SUBSCRIPTION MANAGEMENT TOOL GUIDE... Manuel utilisateur

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Manuel utilisateur

Novell

Novell GROUPWISE 8 - MONITOR Manuel utilisateur

Novell

Novell PRIVILEGED USER MANAGER 2.2.1 - ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION - V8.0.3 INTEGRATION AND STREAMING... Manuel utilisateur

Novell

Novell GROUPWISE 8 - DOMAINS Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 11 - DEPLOYMENT Guide de référence rapide

Novell

Novell CLIENT FOR LINUX 2.0 SP3 Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuel utilisateur

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION - V8.0.3 INTEGRATION AND STREAMING... Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 10 - ARCHITECTURE-SPECIFIC INFORMATION... Manuel

Novell

Novell APPARMOR - AND Manuel

Novell

Novell INTELLISYNC MOBILE SUITE 7.0 - SECURE GATEWAY ADMINISTRATOR GUIDE... Manuel de service

Novell

Novell IDENTITY MANAGER 3.6.1 Manuel utilisateur

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service