SUSE Linux Enterprise Server

Security and Hardening

Publication Date 03 Feb 2012

Copyright © 2006–2012 Novell, Inc. and contributors. All rights reserved.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled GNU Free Documentation License.

For Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell.com/company/legal/trademarks/tmlist.html. All other third party trademarks are the property of their respective owners. A trademark symbol (®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes a third party trademark.

All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors, nor the translators shall be held liable for possible errors or the consequences thereof.


Contents

About This Guide
1. Assumptions and Scope
2. Available Documentation
3. Feedback
4. Documentation Conventions
I. and Common CriteriaSUSE Linux Enterprise Server
1. Overview and rationale
1.1. Common Criteria and this document
1.2. Generic Guiding Principles
II. General System Security and Service Protection Methods
2. Introduction
3. Linux Security in General
3.1. Physical Security
3.2. Locking down the BIOS
3.3. Security via the Boot Loaders
3.4. Verifying Security Action with seccheck
3.5. Retiring Linux Servers with Sensitive Data
3.6. Backups
3.7. Disk Partitions
3.8. Firewall (iptables)
3.9. Security Features in the Kernel
3.10. AppArmor
3.11. SELinux
3.12. FTP, telnet, and rlogin (rsh)
3.13. Removing Unnecessary Software Packages (RPMs)
3.14. Patching Linux Systems
3.15. Securing the Network - Open Network Ports Detection
3.16. Disabling Runlevel Services
3.17. xinetd Services - Disabling
3.18. Reviewing Inittab and Boot Scripts
3.19. Restricting System Access from Servers and Networks
3.20. Securing SSH
3.21. Securing Postfix
3.22. Filesystems: Securing NFS
3.23. Copying Files Using SSH Without Providing Login Prompts
3.24. Checking File Permissions and Ownership
3.25. Default umask
3.26. SUID/SGID Files
3.27. World-Writable Files
3.28. Orphaned or Unowned Files
3.29. Various Account Checks
3.30. Single User Mode Password for root
3.31. Enabling Password Aging
3.32. Stronger Password Enforcement
3.33. Leveraging an Effective pam-stack
3.34. Preventing Accidental Denial of Service
3.35. Displaying Login Banners
3.36. Miscellaneous

List of Tables

3.1. init Services and their Descriptions - Examples
3.2. Sample rules/constraints for password enforcement