SUSE Linux Enterprise Server 11 SP4

Security and Hardening

Publication Date 19 Jun 2015

Copyright © 2006–2015 SUSE LLC and contributors. All rights reserved.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled GNU Free Documentation License.

For SUSE and Novell trademarks, see the Novell Trademark and Service Mark list http://www.novell.com/company/legal/trademarks/tmlist.html. All other third party trademarks are the property of their respective owners. A trademark symbol (®, ™ etc.) denotes a SUSE or Novell trademark; an asterisk (*) denotes a third party trademark.

All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its affiliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof.


Contents

About This Guide
1. Assumptions and Scope
2. Available Documentation
3. Feedback
4. Documentation Conventions
I. SUSE Linux Enterprise Server and Common Criteria
1. Overview and Rationale
1.1. Common Criteria and this document
1.2. Generic Guiding Principles
II. General System Security and Service Protection Methods
2. Introduction
3. Linux Security in General
3.1. Physical Security
3.2. Locking down the BIOS
3.3. Security via the Boot Loaders
3.4. Verifying Security Action with seccheck
3.5. Retiring Linux Servers with Sensitive Data
3.6. Backups
3.7. Disk Partitions
3.8. Firewall (iptables)
3.9. Security Features in the Kernel
3.10. AppArmor
3.11. SELinux
3.12. FTP, telnet, and rlogin (rsh)
3.13. Removing Unnecessary Software Packages (RPMs)
3.14. Patching Linux Systems
3.15. Securing the Network - Open Network Ports Detection
3.16. Disabling Runlevel Services
3.17. xinetd Services - Disabling
3.18. Reviewing Inittab and Boot Scripts
3.19. Restricting System Access from Servers and Networks
3.20. Securing SSH
3.21. Securing Postfix
3.22. Filesystems: Securing NFS
3.23. Copying Files Using SSH Without Providing Login Prompts
3.24. Checking File Permissions and Ownership
3.25. Default umask
3.26. SUID/SGID Files
3.27. World-Writable Files
3.28. Orphaned or Unowned Files
3.29. Various Account Checks
3.30. Single User Mode Password for root
3.31. Enabling Password Aging
3.32. Stronger Password Enforcement
3.33. Leveraging an Effective pam-stack
3.34. Preventing Accidental Denial of Service
3.35. Displaying Login Banners
3.36. Miscellaneous

List of Tables

3.1. init Services and their Descriptions - Examples
3.2. Sample rules/constraints for password enforcement

SUSE Linux Enterprise Server Security and Hardening 11 SP4