Contents
Security Guide
- About This Guide
- 1 Security and Confidentiality
- I Authentication
- II Local Security
- III Network Security
- IV Confining Privileges with AppArmor
- 18 Introducing AppArmor
- 19 Getting Started
- 20 Immunizing Programs
- 21 Profile Components and Syntax
- 22 AppArmor Profile Repositories
- 23 Building and Managing Profiles with YaST
- 24 Building Profiles from the Command Line
- 25 Profiling Your Web Applications Using ChangeHat
- 26 Confining Users with
pam_apparmor - 27 Managing Profiled Applications
- 28 Support
- 29 AppArmor Glossary
- V SELinux
- VI The Linux Audit Framework
- A Documentation Updates
- B GNU Licenses
SUSE Linux Enterprise Desktop 12
Introduces basic concepts of system security, covering both local and network security aspects. Shows how to make use of the product inherent security software like AppArmor or the auditing system that reliably collects information about any security-relevant events.
Publication date: Sep 30 2014
- About This Guide
- 1 Security and Confidentiality
- I Authentication
- II Local Security
- III Network Security
- IV Confining Privileges with AppArmor
- 18 Introducing AppArmor
- 19 Getting Started
- 20 Immunizing Programs
- 21 Profile Components and Syntax
- 22 AppArmor Profile Repositories
- 23 Building and Managing Profiles with YaST
- 24 Building Profiles from the Command Line
- 25 Profiling Your Web Applications Using ChangeHat
- 26 Confining Users with
pam_apparmor - 27 Managing Profiled Applications
- 28 Support
- 29 AppArmor Glossary
- V SELinux
- VI The Linux Audit Framework
- 31 Understanding Linux Audit
- 31.1 Introducing the Components of Linux Audit
- 31.2 Configuring the Audit Daemon
- 31.3 Controlling the Audit System Using
auditctl - 31.4 Passing Parameters to the Audit System
- 31.5 Understanding the Audit Logs and Generating Reports
- 31.6 Querying the Audit Daemon Logs with
ausearch - 31.7 Analyzing Processes with
autrace - 31.8 Visualizing Audit Data
- 31.9 Relaying Audit Event Notifications
- 32 Setting Up the Linux Audit Framework
- 33 Introducing an Audit Rule Set
- 33.1 Adding Basic Audit Configuration Parameters
- 33.2 Adding Watches on Audit Log Files and Configuration Files
- 33.3 Monitoring File System Objects
- 33.4 Monitoring Security Configuration Files and Databases
- 33.5 Monitoring Miscellaneous System Calls
- 33.6 Filtering System Call Arguments
- 33.7 Managing Audit Event Records Using Keys
- 34 Useful Resources
- A Documentation Updates
- B GNU Licenses
List of Figures
- 3.1 Setting Domain and Address of a NIS Server
- 4.1 Authentication Client Configuration
- 4.2 Authentication Client: Adding New Domain (LDAP and Kerberos)
- 5.1 Structure of an LDAP Directory
- 6.1 Active Directory Authentication Schema
- 6.2 Determining Windows Domain Membership
- 6.3 Providing Administrator Credentials
- 8.1 YaST Security Center and Hardening: Security Overview
- 10.1 Minimum ACL: ACL Entries Compared to Permission Bits
- 10.2 Extended ACL: ACL Entries Compared to Permission Bits
- 15.1 iptables: A Packet's Possible Paths
- 16.1 Routed VPN
- 16.2 Bridged VPN - Scenario 1
- 16.3 Bridged VPN - Scenario 2
- 16.4 Bridged VPN - Scenario 3
- 17.1 YaST CA Module—Basic Data for a Root CA
- 17.2 YaST CA Module—Using a CA
- 17.3 Certificates of a CA
- 17.4 YaST CA Module—Extended Settings
- 24.1
aa-notify Message in GNOME - 25.1 Adminer login page
- 30.1 Selecting all SELinux Packages in YaST
- 30.2 Downloading a Policy Package From the openSUSE Download Site
- 31.1 Introducing the Components of Linux Audit
- 31.2 Flow Graph—Program versus System Call Relationship
- 31.3 Bar Chart—Common Event Types
List of Tables
List of Examples
- 2.1 PAM Configuration for sshd (
/etc/pam.d/sshd) - 2.2 Default Configuration for the
authSection (common-auth) - 2.3 Default Configuration for the
accountSection (common-account) - 2.4 Default Configuration for the
passwordSection (common-password) - 2.5 Default Configuration for the
sessionSection (common-session) - 2.6 pam_env.conf
- 5.1 Excerpt from schema.core
- 16.1 VPN Server Configuration File
- 16.2 VPN Client Configuration File
- 19.1 Output of
aa-unconfined - 24.1 Learning Mode Exception: Controlling Access to Specific Resources
- 24.2 Learning Mode Exception: Defining Permissions for an Entry
- 30.1 Security Context Settings Using
ls -Z - 30.2 Verifying that SELinux is functional
- 30.3 Getting a List of Booleans and Verifying Policy Access
- 30.4 Getting File Context Information
- 30.5 The default context for directories in the root directory
- 30.6 Showing SELinux settings for processes
- 30.7 Viewing Default File Contexts
- 30.8 The First 20 Lines of
apache.fc - 30.9 Example Lines from
/etc/audit/audit.log - 30.10 Analyzing Audit Messages
- 30.11 Viewing Which Lines Deny Access
- 30.12 Creating a Policy Module Allowing an Action Previously Denied
- 30.13 Messages That Appear Before the System Stops
- 31.1 Example output of
auditctl-s - 31.2 Example Audit Rules—Audit System Parameters
- 31.3 Example Audit Rules—File System Auditing
- 31.4 Example Audit Rules—System Call Auditing
- 31.5 Deleting Audit Rules and Events
- 31.6 Listing Rules with
auditctl-l - 31.7 A Simple Audit Event—Viewing the Audit Log
- 31.8 An Advanced Audit Event—Login via SSH
- 31.9 Example /etc/audisp/audispd.conf
- 31.10 Example /etc/audisp/plugins.d/syslog.conf
Copyright © 2006–2017 SUSE LLC and contributors. All rights reserved.
この文書は、GNUフリー文書ライセンスのバージョン1.2または(オプションとして)バージョン1.3の条項に従って、複製、頒布、および/または改変が許可されています。ただし、この著作権表示およびライセンスは変更せずに記載すること。ライセンスバージョン1.2のコピーは、“GNUフリー文書ライセンス”セクションに含まれています。
SUSEおよびNovellの商標については、商標とサービスマークの一覧http://www.novell.com/company/legal/trademarks/tmlist.htmlを参照してください。他のすべての第三者の商標は、各商標権者が所有しています。商標記号(®、™など) は、SUSEまたはNovellの商標を示し、アスタリスク(*)は、サードパーティの商標を示します。
本書のすべての情報は、細心の注意を払って編集されています。しかし、このことは絶対に正確であることを保証するものではありません。SUSE LLC、その関係者、著者、翻訳者のいずれも誤りまたはその結果に対して一切責任を負いかねます。