Advanced SUSE Linux

Enterprise Server
Administration (Course 3038)
Chapter 4
Secure a SLES 9 Server

Objectives

Create a Security Concept

Limit Physical Access to Server Systems
Limit the Installed Software Packages
Understand the Linux User Authentication
Ensure File System Security
Use ACLs for Advanced Access Control
Configure Security Settings with YaST
Stay Informed About Security Issues
Apply Security Updates

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Create a Security Concept

Objectives

Understand the Basics of a Security Concept

Perform a Communication Analysis
Analyze the Protection Requirements
Analyze the Current Situation and Necessary
Enhancements

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Understand the Basics of a Security

Concept
You must know what you are protecting your system
from
If users work on different computers and use
common resources
Security concept pertaining to a network must be
considered

Creating security concept

Helps to detect errors and sources of danger that are
not obvious
Provides good documentation of the concept
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Protection Requirements

Expense of securing individual resources
Determined by amount of potential damage

Estimate frequency of occurrence of possible

damage
To use in your calculations

Important parts of the communication analysis

Can be represented in tables, also known as access
matrices

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Current Situation and

Necessary Enhancements
Company-wide security policy should guarantee
Confidentiality, data integrity, availability, and
transparency

Security policy
Determines what security demands are required for
specific data and resources
Should include the analysis of the remaining risk
Describes the current actual state of security

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Current Situation and

Necessary Enhancements (continued)
Security of Network Components

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Current Situation and

Necessary Enhancements (continued)
Power failure measures

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Current Situation and

Necessary Enhancements (continued)
Fire fighting measures

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

Analyze the Current Situation and

Necessary Enhancements (continued)
Data storage issues

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

10

Analyze the Current Situation and

Necessary Enhancements (continued)
Software security updates

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

11

Analyze the Current Situation and

Necessary Enhancements (continued)
Virus protection of the IT systems

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

12

Analyze the Current Situation and

Necessary Enhancements (continued)
Documentation of the IT infrastructure

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

13

Limit Physical Access to Server

Systems
Objectives
Place the Server in a Separate, Locked Room
Secure the BIOS with a Password
Secure the GRUB Boot Loader with a Password

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

14

Limit the Installed Software Packages

Remove unnecessary software packages
From a production server

A server should never offer any network services that

are not needed
Check which services are configured to start and their
run levels
chkconfig -l
Command displays a line for every service installed

Remove a service from its default run levels:

insserv -r service_name
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

15

Understand the Linux User

Authentication
Authentication on a Linux system
Based on Pluggable Authentication Modules (PAM)

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

16

How PAM Works

Pluggable Authentication Modules (PAM)
Collection of software modules
Handles the authentication process

User logs into a Linux system on a virtual terminal

Program called login is usually called

Before PAM was introduced

Login and all other applications had to be extended to
support a different authentication process

PAM creates a software level

With clearly defined interfaces
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

17

How PAM Works (continued)

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

18

PAM Configuration
PAM modules are located in directory /lib/security
Every filename starts with the prefix pam_.

PAM configuration is done in directory /etc/pam.d/

Contains a configuration file for every application that
uses PAM

Configuration file entries structure

module-type
Auth, account, session, password

control-flag
Required, sufficient, optional, etc.
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

19

PAM Configuration (continued)

Configuration file entries structure (continued)
auth required pam_env.so
auth required pam_mail.so
password required pam_pwcheck.so

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

20

The Requirements for a Secure

Password
Even the best security setup for a system
Can be defeated if users choose easy to guess
passwords

Dictionary attacks
Password cracking program just tries one word after
another from a dictionary file

Enable a special PAM module pam_pwcheck.so

To test a password first before a user can set it

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

21

Ensure File System Security

Objectives
The Basic Rule for User Write Access
The Basic Rule for User Read Access
How Special File Permissions Affect the Security of
the System

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

22

The Basic Rule for User Write Access

File systems used in Linux
Structurally similar to UNIX file systems
Support the typical UNIX file access permissions
(read, write, execute, sticky bit, SUID, SGID, etc.)

Normal user should only have write access to

The home directory of the user
The /tmp directory to store temporary files

Depending on the purpose of a computer

Other directories can be writable by users
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

23

The Basic Rule for User Read Access

Some files should be protected from user read
access
Especially files that store passwords

/etc/shadow
/etc/samba/smbpasswd
Files with Apache passwords
/etc/openldap/slapd.conf
/boot/grub/menu.lst

Some password files can be readable for a nonroot

account
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

24

How Special File Permissions Affect

the Security of the System
Three file system rights that influence the security in
a special way
SUID bit
Set for an executable
Program is started under the user ID of the file owner

SGID bit
Lets program run under the GID of the group to which
the executable file belongs

Sticky bit
Prevents users from deleting/renaming each others files
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

25

Use ACLs for Advanced Access

Control

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

26

The Basics of ACLs

Set of permissions
read (r), write (w), execute (x)

Types of users
File owner, group, and other users

ACLs (Access Control Lists)

Assign permissions to individual users or groups
Supported by the ReiserFS, Ext2, Ext3, JFS, and XFS

Useful when
Replacing Windows server with Linux server
Providing file and print services with Samba
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

27

Important ACL Terms

user class
The owner, the owning group, and other users

access ACL
User and group access permissions for all kinds of file
system objects

default ACL
Determine the permissions a file system object inherits
from its parent directory

ACL entry
Contains a type, a qualifier for the user or group to which
the entry refers, and a set of permissions
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

28

ACL Types
Two basic classes of ACLs
Minimum ACL, Extended ACL

ACLs extend the classic Linux file permission

By the following permission types
named user, named group, mask

Permissions defined in the entries owner and other

are always effective

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

29

How ACLs and Permission Bits Map to

Each Other
Assigning an ACL to a file or directory
Permissions set in the ACL are mapped to the
standard UNIX permissions

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

30

How to Use the ACL Command-Line

Tools
Command-line tools
getfacl
setfacl

Examples
setfacl -m u:tux:rx my_file
setfacl -m g:accounting:rw my_file
setfacl -m m:rx

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

31

How to Configure a Directory with an

Access ACL
Steps
Use the umask command to define access permissions
to be masked
Each time a file object is created

Check initial state of the ACL by entering:

getfacl mydir

Modify the ACL

setfacl -m user:jane:rwx,group:jungle:rwx mydir

Take a look at the resulting ACL:

getfacl mydir

Add or remove permissions with chmod

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

32

How to Configure a Directory with a

Default ACL
Default ACL
Defines access permissions objects under the
directory inherit when they are created

Passing permissions of a directorys default ACL

Subdirectory inherits default ACL of parent directory
Both as its own default ACL and as an access ACL

File inherits default ACL as its own access ACL

Parent directory does not have a default ACL

umask permission bits are subtracted from the mode
parameter permissions
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

33

How to Configure a Directory with a

Default ACL (continued)
Parent directory has a default ACL
Permission bits correspond to overlapping portion of
mode parameter permissions and default ACL

Add a default ACL to the existing directory mydir

setfacl -d -m group:jungle:r-x mydir

Create a subdirectory in mydir, which inherits the

default ACL
mkdir mydir/mysubdir
getfacl mydir/mysubdir
Advanced SUSE Linux Enterprise Server Administration (Course 3038)

34

How Applications Handle ACLs

Important applications still lack ACL support
There are no backup applications that guarantee full
preservation of ACLs

Basic file commands (cp, mv, ls, and so on) support

ACLs
But many editors and file managers (such as
Konqueror) do not

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

35

Configure Security Settings with YaST

Open the YaST Control Center
Select Security and Users > Security settings

You can change the following settings

The password settings

The boot behavior of the system
The login behavior
The user ID limitations
General file system security

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

36

Configure Security Settings with YaST

Levels of Local Security

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

37

Configure Security Settings with YaST

Password Settings (continued)

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

38

Configure Security Settings with YaST

Boot Settings

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

39

Configure Security Settings with YaST

Login Behavior of the System

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

40

Configure Security Settings with YaST

User/Group ID Limitations

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

41

Configure Security Settings with YaST

Setting of File Permissions

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

42

Configure Security Settings with YaST

(continued)

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

43

Stay Informed About Security Issues

Resources
www.suse.de/en/business/security.html
www.suse.de/en/business/mailinglists.html
suse-security
suse-security-announce

www.securityfocus.com/

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

44

Register Your Product

Access the update packages
Need to enter a user name and a password
Create an account for the SUSE support portal

SUSE support portal http://portal.suse.com

Register your product in the portal
With registration code delivered with the SLES 9 DVD

Registered products can be updated with the YOU

module (Enterprise Server, not OpenSUSE)

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

45

Use the YaST Online Update

Steps for SLES9 use the YOU module (YaST),
Steps for OpenSUSE - use the Online Update
module (YaST)
module retrieves information about the available
patches
Select packages to install
By selecting Accept, the selected updates are
downloaded and installed

Advanced SUSE Linux Enterprise Server Administration (Course 3038)

46