Guide to the Secure Configuration of SUSE Linux Enterprise 15

PRELINKING=no

$ sudo /usr/sbin/prelink -ua

• GnuTLS library
• OpenSSL library
• NSS library
• OpenJDK
• Libkrb5
• BIND
• OpenSSH

$ sudo yum remove gdm

dconf update

/etc/dconf/db/gdm.d

/etc/dconf/db/local.d

user-db:user
system-db:gdm

$ sudo zypper install sudo

 sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)$' 

 Defaults !targetpw
      Defaults !rootpw
      Defaults !runaspw 

 sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; 

 /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw 

$ sudo chgrp root /etc/sudoers.d

$ sudo chown root /etc/sudoers.d 

$ sudo chmod 0750 /etc/sudoers.d

$ sudo chgrp root /etc/sudoers

$ sudo chown root /etc/sudoers 

$ sudo chmod 0440 /etc/sudoers

$ sudo chmod 4111 /usr/bin/sudo

$ sudo zypper install gnutls-utils

$ sudo zypper install nss-tools

$ sudo zypper install dnf-automatic

gpgcheck=1

gpgcheck=0

$ sudo zypper install suse-build-key

$ sudo rpm --import /media/cdrom/content.key

$ sudo rpm --import /media/cdrom/repodata/repomd.xml.key

sudo rpm --import /var/cache/zypp/raw/Basesystem_Module_15_SP2_x86_64:SLE-Module-Basesystem15-SP2-Pool/repodata/repomd.xml.key

$ sudo zypper refresh && sudo zypper list-patches -g security

$ sudo systemctl enable dnf-automatic.timer

$ sudo chgrp root /etc/issue

$ sudo chgrp root /etc/issue.net

$ sudo chgrp root /etc/motd

$ sudo chown root /etc/issue 

$ sudo chown root /etc/issue.net 

$ sudo chown root /etc/motd 

$ sudo chmod 0644 /etc/issue

$ sudo chmod 0644 /etc/issue.net

$ sudo chmod 0644 /etc/motd

$ sudo grep pam_succeed_if /etc/pam.d/sudo

session     optional    pam_lastlog.so showfailed

session    required     pam_namespace.so

$ sudo systemctl mask --now debug-shell.service

CtrlAltDelBurstAction=none

ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target

systemctl mask ctrl-alt-del.target

systemd.confirm_spawn=(1|yes|true|on)

/usr/bin/grub2-editenv - unset systemd.confirm_spawn>

grub2-mkconfig -o /boot/grub2/grub.cfg

[Login]

StopIdleSessionSec=
        

$ sudo userdel unauthorized_user
        

$ sudo chage -I NUM_DAYS USER
        

$ sudo chage -M 180 -m 7 -W 7 USER

CREATE_HOME yes

FAIL_DELAY 
        

* hard maxlogins 
        

$ sudo mkdir --mode 000 /tmp/tmp-inst

/tmp     /tmp/tmp-inst/            level      root,adm

$ sudo mkdir --mode 000 /var/tmp/tmp-inst

/var/tmp /var/tmp/tmp-inst/    level      root,adm

TMOUT=
        

/etc/passwd

$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE
        

$ sudo chmod o-w FILE
        

$ sudo chown USER /home/USER/.*

$ sudo mkdir /home/USER
        

$ sudo chgrp USER_GROUP /home/USER/FILE_DIR
        

$ sudo chown -R USER /home/USER
        

$ sudo chmod 0750 /home/USER/FILE_DIR
        

$ sudo chgrp USER_GROUP /home/USER
        

$ sudo chown USER /home/USER
        

$ sudo chmod 0740 /home/USER/.INIT_FILE
        

$ sudo chmod 0750 /home/USER
        

# ls -ld /home/USER
        

# chmod g-w /home/USER
# chmod o-rwx /home/USER
        

# echo $PATH

$ sudo chgrp root /boot/grub2/grub.cfg

$ sudo chown root /boot/grub2/grub.cfg 

$ sudo chmod 600 /boot/grub2/grub.cfg

# grub2-mkpasswd-pbkdf2

set superusers="boot"
password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString

grub2-mkconfig -o /boot/grub2/grub2.cfg

$ sudo chgrp root /boot/grub2/user.cfg

$ sudo chown root /boot/grub2/user.cfg 

$ sudo chmod 600 /boot/grub2/user.cfg

# grub2-mkpasswd-pbkdf2

set superusers="boot"
password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString

grub2-mkconfig -o /boot/grub2/grub2.cfg

$ sudo chgrp root /boot/grub2/grub.cfg

$ sudo chgrp root /boot/grub2/user.cfg

$ sudo chown root /boot/grub2/grub.cfg 

$ sudo chown root /boot/grub2/user.cfg 

$ sudo chmod 700 /boot/grub2/grub.cfg

$ sudo chmod 600 /boot/grub2/user.cfg

$ActionSendStreamDriverAuthMode x509/name

action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")

$ActionSendStreamDriverMode 1

action(type="omfwd" ... StreamDriverMode="1")

$DefaultNetstreamDriver gtls

global(DefaultNetstreamDriver="gtls")

$ ls -l LOGFILE
        

$ sudo chgrp root LOGFILE
        

$ ls -l LOGFILE
        

$ sudo chown root LOGFILE
        

$ ls -l LOGFILE
        

$ sudo chmod 640 LOGFILE
        

$ sudo systemctl enable systemd-journald.service

 $ sudo zypper install logrotate

# rotate log files frequency
daily

$ sudo systemctl enable logrotate.timer

$ sudo zypper install syslog-ng-core

$ sudo systemctl enable syslog-ng.service

$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port
        

module(load="imtcp")
module(load="imudp")
input(type="imtcp" port="514")
input(type="imudp" port="514")

*.* @
        

*.* @@
        

*.* :omrelp:
        

echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf

echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.conf

• drop
  

  Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.

• block
  

  Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.

• public
  

  For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• external
  

  For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• dmz
  

  For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.

• work
  

  For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• home
  

  For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• internal
  

  For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

• trusted
  

  All network connections are accepted.

# firewall-cmd --zone=public --list-all

# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench

# firewall-cmd --get-service

# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https

# firewall-cmd --get-service --permanent

$ sudo zypper install libreswan

$ sudo chgrp root /etc/ipsec.d

$ sudo chown root /etc/ipsec.d 

$ sudo chmod 0700 /etc/ipsec.d

$ sudo chgrp root /etc/ipsec.conf

$ sudo chgrp root /etc/ipsec.secrets

$ sudo chown root /etc/ipsec.conf 

$ sudo chown root /etc/ipsec.secrets 

$ sudo chmod 0644 /etc/ipsec.conf

$ sudo chmod 0644 /etc/ipsec.secrets

$ sudo zypper install iptables

$ sudo iptables -nL --line-numbers

$ sudo service iptables restart

Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination

$ sudo chgrp root /etc/iptables

$ sudo chown root /etc/iptables 

$ sudo chmod 0700 /etc/iptables