| SUSE Linux Documentation Chapter 8. System Configuration with YaST / 8.9. Security and Users | ||||
|---|---|---|---|---|
 | 8.8. AppArmor | 8.10. Virtualization |  | |
| SUSE Linux Documentation Chapter 8. System Configuration with YaST / 8.9. Security and Users | ||||
|---|---|---|---|---|
| 8.8. AppArmor | 8.10. Virtualization | | |
A basic aspect of Linux is its multiuser capability. Consequently, several users can work independently on the same Linux system. Each user has a user account identified by a login name and a personal password for logging in to the system. All users have their own home directories where personal files and configurations are stored.
Create and edit users with +. It provides an overview of users in the system, including NIS, LDAP, Samba, and Kerberos users if requested. If you are part of an extensive network, click to list all users categorically. You can also customize the filter settings by clicking .
![[Tip]](admon/tip.png) | Applying Configuration Changes without Closing the Module |
|---|---|
Whenever you need to make multiple configuration changes and want to avoid restarting the user and group configuration module for every single one of these changes, use to save your changes without exiting the configuration module. | |
To add a new user, proceed as follows:
Click .
Enter the necessary data for . If you do not need to adjust any more detailed settings for this new user, proceed to Step 5.
To change a user's ID, home directory name, default home, group, group memberships, directory permissions, or login shell, open the tab and change the default values.
To adjust user's password expiration, length, and expiration warnings, use the tab.
Write the user account configuration by clicking .
The new user can immediately log in with the created login name and password.
To delete a user, proceed as follows:
Select the user from the list.
Click .
Determine whether to delete or keep the home directory of the user to delete.
Click to apply your settings.
To change the login configuration, proceed as follows:
Select the user from the list.
Click .
Adjust the settings under , , and .
Save the user account configuration by clicking .
You can create an encrypted home directory as part of the user account creation. To create an encrypted home directory for a user, proceed as follows:
Click .
Enter the required data for .
In the tab, activate .
Apply your settings with .
To create an encrypted home for an existing user, proceed as follows:
Select a user from the list and click .
In the tab, enable .
Enter the password of the selected user.
Apply your settings with .
To disable the encryption of home directories, proceed as follows:
Select a user from the list and click .
In the tab, disable .
Enter the password of the selected user.
Apply your settings with .
For more information about encrypted homes, see Section 47.2, “Using Encrypted Home Directories”.
![[Warning]](admon/warning.png) | Using Auto Login |
|---|---|
Using the auto login feature on any system that can be physically accessed by more than one person is a potential security risk. Any user accessing this system can manipulate the data on it. If your system contains confidential data, do not use the auto login functionality. | |
If you are the only user of your system, you can configure auto login. It automatically logs a user into the system after start. Only one selected user can use the auto login function. Auto login works only with KDM or GDM.
To activate auto login, select the user from the list of users and click +. Then choose and click .
To deactivate this functionality, select the user and click +. Then uncheck and click .
| Allowing Login without a Password |
|---|---|
Using the passwordless login feature on any system that can be physically accessed by more than one person is a potential security risk. Any user accessing this system can manipulate the data on it. If your system contains confidential data, do not use this functionality. | |
Login without a password automatically logs a user into the system after the user enters the username in the login manager. It is available to multiple users on a system and works only with KDM or GDM.
To activate the function, select the user from the list of users and click +. Then choose and click .
To deactivate this function, select the user for whom to disable this functionality from the list of users and click +. Then uncheck and click .
To create a system user that should not be able to log in to the system but under whose identity several system-related tasks should be managed, disable the user login when creating the user account. Proceed as follows:
Click .
Enter the required data for .
Check .
Apply your settings with .
To disable login for an existing user, proceed as follows:
Select the user from the list and click .
Check in .
Apply your settings with .
On any system with multiple users, it is a good idea to enforce at least basic password security policies. Users should change their passwords regularly and use strong passwords that cannot easily be exploited. For information about how to enforce stricter password rules, refer to Section 8.9.3, “Local Security”. To enforce password rotation, create a password expiration policy.
To configure the password expiration policy for a new user, proceed as follows:
Click .
Enter the required data in .
Adjust the values in .
Apply your settings with .
To change the password expiration policy for an existing user, proceed as follows:
Select the user from the list and click .
Adjust the values in .
Apply your settings with .
You can limit the lifetime of any user account by specifying a date
of expiration for this particular account. Specify the in the YYYY-MM-DD format and
leave the user configuration. If no is
given, the user account never expires.
When creating new local users, several defaults settings are used by YaST. You can change these default settings to meet your requirements:
Select +.
Apply your changes to any or all of the following items:
Apply your changes with .
Several other security-related default settings can be changed using the module. Refer to Section 8.9.3, “Local Security” for information.
![[Note]](admon/note.png) | Note |
|---|---|
Changes in password encryption apply only to local users. | |
SUSE Linux Enterprise can use DES, MD5, or Blowfish for password encryption. The default password encryption method is Blowfish. The encryption method is set during installation of the system, as described in Section 3.14.1, “Password for the System Administrator “root””. To change the password encryption method in the installed system, select +.
The user administration method (such as NIS, LDAP, Kerberos, or Samba) is set during installation, as described in Section 3.14.7, “Users”. To change the user authentication method in the installed system, select +. The module provides a configuration overview and the option to configure the client. Advanced client configuration is also possible using this module.
To create and edit groups, select + or click in the user administration module. Both dialogs have the same functionality, allowing you to create, edit, or delete groups.
The module gives an overview of all groups. As in the user management dialog, change filter settings by clicking .
To add a group, click and enter the appropriate data. Select group members from the list by checking the corresponding box. Click to create the group. To edit a group, select the group to edit from the list and click . Make all necessary changes then save them with . To delete a group, simply select it from the list and click .
Click for advanced group management. Find more about these options in Section 8.9.1, “User Management”.
To apply a set of security settings to your entire system, use +. These settings include security for booting, login, passwords, user creation, and file permissions. SUSE Linux Enterprise offers three preconfigured security sets: , , and . Modify the defaults with . To create your own scheme, use .
The detailed or custom settings include:
To have new passwords checked by the system for security before they are accepted, click and . Set the minimum password length for newly created users. Define the period for which the password should be valid and how many days in advance an expiration alert should be issued when the user logs in to the text console.
Set how the key combination Ctrl+Alt+Del should be interpreted by selecting the desired action. Normally, this combination, when entered in the text console, causes the system to reboot. Do not modify this setting unless your machine or server is publicly accessible and you are afraid someone could carry out this action without authorization. If you select , this key combination causes the system to shut down. With , this key combination is ignored.
If you use the KDE login manager (KDM), set permissions for shutting down the system in . Give permission to (the system administrator), , , or . If is selected, the system can only be shut down from the text console.
Typically, following a failed login attempt, there is a waiting
period lasting a few seconds before another login is possible. This
makes it more difficult for password sniffers to log in. Optionally
activate . If you
suspect someone is trying to discover your password, check the entries
in the
system log files in /var/log. To grant other users
access to your graphical login screen over the network, enable
.
Because this access possibility represents a potential security risk,
it is inactive by default.
Every user has a numerical and an alphabetical user ID. The
correlation between these is established using the file
/etc/passwd and should be as unique as possible.
Using the data in this screen, define the range of numbers assigned
to the numerical part of the user ID when a new user is added. A
minimum of 500 is suitable for users. Automatically generated
system users start with 1000. Proceed in the same way with the
group ID settings.
To use predefined file permission settings, select , , or . should be sufficient for most users. The setting is extremely restrictive and can serve as the basic level of operation for custom settings. If you select , remember that some programs might not work correctly or even at all, because users no longer have permission to access certain files.
Also set which user should launch the
updatedb program, if installed.
This program, which automatically runs on a daily basis or after
booting, generates a database (locatedb) in which the location of
each file on your computer is stored. If you select
, any user can find only the paths in the
database that can be seen by any other (unprivileged) user. If
root is selected, all local
files are indexed, because the user
root, as superuser, may
access all directories. Make sure that the options
and
are
deactivated. Only advanced users should consider using these options
because
these settings may pose a significant security risk if used incorrectly.
To have some control over the system even if it crashes, click
.
Click to complete your security configuration.
Certificates are used for communication and can also be found, for example, on company ID cards. To manage them or import a common server certificate, use +. Detailed information about certificates, their technologies, and management with YaST are provided in Chapter 42, Managing X.509 Certification.
SuSEfirewall2 can protect your machine against attacks from the Internet. Configure it with +. Find detailed information about SuSEfirewall2 in Chapter 43, Masquerading and Firewalls.
| Automatic Activation of the Firewall |
|---|---|
YaST automatically starts a firewall with suitable settings on every configured network interface. Start this module only if you want to reconfigure the firewall with custom settings or deactivate it. | |
