33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
|
# File '../../src/include/security/helps.rb', line 33
def initialize_security_helps(include_target)
textdomain "security"
@HELPS = {
"read" => _(
"<p><b><big>Initializing Security Configuration</big></b>\n<br>Please wait...<br></p>"
) +
_(
"<p><b><big>Aborting the Initialization</big></b><br>\nSafely abort the configuration utility by pressing <b>Abort</b> now.</p>"
),
"write" => _(
"<p><b><big>Saving Security Configuration</big></b>\n<br>Please wait...<br></p>"
) +
_(
"<p><b><big>Aborting Saving</big></b><br>\nAbort the save procedure by pressing <b>Abort</b>.</p>"
),
"boot" => _(
"<p><b><big>Boot Security</big></b></p>\n<p>In this dialog, change various boot settings related to security.</p>"
) +
_(
"<p><b>Interpretation of Ctrl + Alt + Del</b>:\n" +
"Configure what the system should do in response to\n" +
"someone at the console pressing the CTRL + ALT + DEL key\n" +
"combination. Usually the system reboots. Sometimes it is desirable\n" +
"to ignore this event, for example, when the system serves as both\n" +
"workstation and server.</p>"
) +
_(
"<p><b>Shutdown Behaviour of Login Manager</b>:\nSet who is allowed to shut down the machine from KDM.</p>\n"
) +
_(
"<p><b>Hibernate System</b>:\n" +
"Set the conditions for allowing users to hibernate the system. By default, user on active console has such right.\n" +
"Other options are allowing the action to any user or requiring authentication in all cases.</p>\n"
),
"main" => _(
"<P><BIG><B>Configuring Local Security</B></BIG></P>\n" +
"<p>Using predefined defaults, change the local security settings, which include\n" +
" booting, login, password, user creation, and file permissions. The default\n" +
" settings can be modified as needed.\n" +
"</p>"
) +
_(
"<p><b>Home Workstation</b>: For a home computer not connected to\nany type of a network.</p>"
) +
_(
"<p><b>Networked Workstation</b>: For a computer connected\nto any type of network including the Internet.</p>"
) +
_(
"<p><b>Network Server</b>: For a computer that provides\nany type of service.</p>"
) +
_("<p><b>Custom Settings</b>: Create your own configuration.</p>"),
"login" => _(
"<p><big><b>Login Security</b></big></p>\n" +
"<p>These login settings\n" +
"are mainly stored in the /etc/login.defs file.</p>"
) +
_(
"<p><b>Delay after Incorrect Login Attempt:</b>\n" +
"It is advisable to wait some time after an incorrect login attempt to prevent\n" +
"password guessing. Make the time small enough that users do not need to wait to\n" +
"retry if a password is mistyped. A sensible value is three seconds (<tt>3</tt>).</p>"
) +
_(
"<p><b>Record Successful Login Attempts:</b> Logging successful login\n" +
"attempts is useful. It can warn you of unauthorized access to the\n" +
"system (for example, a user logging in from a different location than usual).\n" +
"</p>\n"
) +
_(
"<p><b>Allow Remote Graphical Login:</b> Checking this allows access\n" +
"to a graphical login screen for this machine over the network. Remote access\n" +
"to your machine using a display manager might be a security risk.</p>"
),
"password" => _(
"<p>These password settings\nare mainly stored in the /etc/login.defs file.</p>"
) +
_(
"<p><b>Check New Passwords</b>: It is wise to choose a password that\n" +
"cannot be found in a dictionary and is not a name or other simple, common word.\n" +
"By checking the box, enforce password checking in regard to these rules.</p>"
) +
_(
"<p><b>Minimum Acceptable Password Length:</b>\n" +
"The minimum acceptable size for the new password reduced by the number\n" +
"of different character classes (other, upper, lower and digit) used in the new\n" +
"password. See man pam_cracklib for a more detailed explanation.\n" +
"This option can only be modified when <b>Check New Passwords</b> is set.</p>"
) +
_(
"<p><b>Passwords to Remember</b>:\n" +
"Enter the number of user passwords to store and prevent the user from reusing.\n" +
"Enter 0 if passwords should not be stored.</p>"
) +
_("<p><b>Password Encryption Method:</b></p>") +
_(
"<p><b>DES</b>, the Linux default method, works in all network environments,\n" +
"but it restricts you to passwords no longer than eight characters. If you need\n" +
"compatibility with other systems, use this method.</p>"
) +
_(
"<p><b>MD5</b> allows longer passwords and is supported by all current Linux \ndistributions, but not by other systems or old software.</p>"
) +
_(
"<p><b>SHA-512</b> is the current standard hash method, using other algorithms is not recommended unless needed for compatibility purpose.</p>"
) +
_(
"<p><b>Password Age:</b> Set the minimum and\nmaximum number of days a password may be used.</p>"
) +
_(
"<p><b>Days before Password Expires Warning</b>: This entry sets the\n" +
"number of days users are warned before their passwords expire. The longer the\n" +
"time, the less likely it is that someone can guess passwords.</p>"
),
"adduser" => _(
"<p><big><b>User Security</b></big></P>\n<p>In this dialog, change various settings used to create users.</p>"
) +
_(
"<p><b>User ID Limitations:</b>\nSet the minimum and maximum possible user ID.</p>"
) +
_(
"<p><b>Group ID Limitations</b>:\nSet the minimum and maximum possible group ID.</p>"
),
"misc" => _(
"<p><big><b>Other Security Settings</b></big></P>\n<p>In this dialog, change miscellaneous settings related to local security.</p>"
) +
_(
"<p><b>File Permissions</b>: Settings for the permissions\n" +
"of certain system files are set according to the data in /etc/permissions.secure\n" +
"or /etc/permissions.easy. Which file is used depends on this selection.\n" +
"Launching SuSEconfig sets these permissions according to /etc/permissions.*.\n" +
"This fixes files with incorrect permissions, whether this occurred accidentally\n" +
"or by intruders.</p><p>\n" +
"With <b>Easy</b>, most of the system files that are only readable by root\n" +
"in Secure are modified so other users can also read these files.\n" +
"Using <b>Secure</b>, certain system files, such as /var/log/messages, can only\n" +
"be viewed by the user root. Some programs can only be launched by root or by\n" +
"daemons, not by ordinary users.\n" +
"The most secure setting is <b>Paranoid</B>. With it, you must\n" +
"decide which users are able to run X applications and setuid programs.</p>\n"
) +
_(
"<p><b>User Launching updatedb</b>: The program updatedb runs \n" +
"once a day. It scans your entire file system and creates a database (locatedb)\n" +
"that stores the location of every file. The database can be searched by the\n" +
"program \"locate\". Here, set the user that runs this command: <b>nobody</b>\n" +
" (few files) or <b>root</b> (all files).</p>"
) +
_(
"<p><b>Current Directory in root's Path</b> On a DOS system,\n" +
"the system first searches for executable files (programs) in the current\n" +
"directory then in the current path variable. In contrast, a UNIX-like system\n" +
"searches for them exclusively via the search path (variable PATH).</p>"
) +
_(
"<p><b>Current Directory in the Path of Regular Users</b><br> A DOS\n" +
"system first searches for executable files (programs) in the current directory\n" +
"then in the current path variable. In contrast, a UNIX-like system searches\n" +
"for them exclusively via the search path (variable PATH).</p>"
) +
_(
"<p>Some systems set up a work-around by adding the dot (\".\") to the\n" +
"search path, enabling files in the current path to be found and executed.\n" +
"This is highly dangerous because you may accidentally launch unknown programs in\n" +
"the current directory instead of the usual systemwide files. As a result,\n" +
"executing <i>Trojan Horses</i>, which exploit this weakness and invade your system,\n" +
"is rather easy if you set this option.</p>"
) +
_(
"<p>\"yes\": the dot (\".\") is attached to the end of the search\npath of root, making it the last to be searched.</p>"
) +
_(
"<p>\"no\": the user root always must launch programs in the\ncurrent directory prefixed with a \"./\". Example: \"./configure\".</p>"
) +
_(
"<p><b>Enable Magic SysRq Keys</b><br> If you check this option, you\n" +
"will have some control over the system even if it crashes (for example, during kernel\n" +
"debugging). For details, see /usr/src/linux/Documentation/sysrq.txt</p>"
),
"overview" => _(
"<P><B>Security Overview</B><BR>This overview shows the most important security settings.</P>"
) +
_(
"<P>To change the current value, click the link associated to the option.</P>"
) +
_(
"<P> A check mark in the <B>Security Status</B> column means that the current value of the option is secure.</P>"
),
"unknown_status" => _(
"<P><B>The current value could not be read. The service is probably not installed or the option is missing on the system.</B></P>"
)
}
@help_mapping = {
"DISPLAYMANAGER_REMOTE_ACCESS" => _(
"<P>A display manager provides a graphical login screen and can be accessed\n" +
"across the network by an X server running on another system if so\n" +
"configured.</P><P>The windows that are being displayed would then transmit\n" +
"their data across the network. If that network is not fully trusted, then the\n" +
"network traffic can be eavesdropped by an attacker, gaining access not only to\n" +
"the graphical content of the display, but also to usernames and passwords that\n" +
"are being used.</P><P>If you do not need <EM>XDMCP</EM> for remote graphical\n" +
"logins, then disable this option.</P>"
),
"SYSTOHC" => _(
"<P>Upon startup, the system time is being set from the hardware clock of the\n" +
"computer. As a consequence, setting the hardware clock before shutting down is\n" +
"necessary.</P><P>Consistent system time is essential for the system to create\n" +
"correct log messages.</P>"
),
"SYSLOG_ON_NO_ERROR" => _(
"<P>Malfunctions in a system are usually detected by anomalies in its behaviour. Syslog messages about events that reoccur on a regular basis are important to find causes of problems. And the absence of a single record can tell more than the absence of all log records.</P><P>Therefore, syslog messages of system events are only useful if they are present.</P>"
),
"DHCPD_RUN_CHROOTED" => _(
"<P>Chroot execution environments restrict a process to only access files that it needs by placing them in a separate subdirectory and running the process with a changed root (chroot) set to that directory.</P>"
),
"DHCPD_RUN_AS" => _(
"<P>The DHCP client daemon should run as the user <EM>dhcpd</EM> to minimize a possible threat if the service is found vulnerable to a weakness in its program code.</P><P>Note that dhcpd must never run as <EM>root</EM> or with the <EM>CAP_SYS_CHROOT</EM> capability for the chroot execution confinement to be effective.</P>"
),
"DISPLAYMANAGER_ROOT_LOGIN_REMOTE" => _(
"<P>Administrators should never log on as <EM>root</EM> into an X Window session to minimize the usage of the root privileges.</P><P>This option does not help against careless administrators, but shall prevent attackers to be able to log on as <EM>root</EM> via the display manager if they guess or otherwise acquire the password.</P>"
),
"DISPLAYMANAGER_XSERVER_TCP_PORT_6000_OPEN" => _(
"<P>X Window clients, e.g. programs that open a window on your display, connect\n" +
"to the X server that runs on the physical machine. Programs can also run on a\n" +
"different system and display their content on the X server through network\n" +
"connections.</P><P>When enabled, the X server listens on a port 6000 plus the\n" +
"display number. Since network traffic is transferred unencrypted and therefore\n" +
"subject to network sniffing, and since the port held open by the X server\n" +
"offers attack options, the secure setting is to disable it.</P><P>To display X\n" +
"Window clients across a network, we recommend the use of secure shell (<EM>ssh</EM>), which allows the X Window clients to connect to the X server through the encrypted ssh connection.</P>"
),
"SMTPD_LISTEN_REMOTE" => _(
"<P>The email delivery subsystem is always started. However, it does not expose\nitself outside the system by default, since it does not listen on the SMTP network port 25.</P><P>If you do not deliver emails to your system through the SMTP protocol, then disable this option.</P>"
),
"DISABLE_RESTART_ON_UPDATE" => _(
"<P>If a package containing a service that is currently running is being\n" +
"updated, the service is restarted after the files in the package have been\n" +
"installed.</P><P>This makes sense in most cases, and it is safe to do,\n" +
"considering that many services either need their binaries or configuration\n" +
"files accessible in the file system. Otherwise these services would continue\n" +
"to run until the services are stopped, e.g. running daemons are\n" +
"killed.</P><P>This setting should only be changed if there is a specific\n" +
"reason to do so.</P>"
),
"DISABLE_STOP_ON_REMOVAL" => _(
"<P>If a package containing a service that is currently running is being\n" +
"uninstalled, the service is stopped before the files of the package are\n" +
"removed.</P><P>This makes sense in most cases, and it is safe to do,\n" +
"considering that many services either need their binaries or configuration\n" +
"files accessible in the file system. Otherwise these services would continue\n" +
"to run until they are stopped, e.g. running daemons are\n" +
"killed.</P><P>This setting should only be changed if there is a specific\n" +
"reason to do so.</P>"
),
"net.ipv4.tcp_syncookies" => _(
"<P>A system can be overwhelmed with numerous connection attempts so that the system runs out of memory, leading to a Denial of Service (DoS) vulnerability.</P><P>The use of syncookies is a method that can help in such situations. But in configurations with a very large number of legitimate connection attempts from one source, the <EM>Enabled</EM> setting can cause problems with denied TCP connections under high load.</P><P>Still, for most environments, syncookies are the first line of defense against SYN flood DoS attacks, so the secure setting is <EM>Enabled</EM>.</P>"
),
"net.ipv4.ip_forward" => _(
"<P>IP forwarding means to pass on network packets that have been received, but that are not destined for one of the system's configured network interfaces, e.g. network interface addresses.</P><P>If a system forwards network traffic on ISO/OSI layer 3, it is called a router. If you do not need that routing functionality, then disable this option.</P>"
) +
_("<P>This setting applies to <EM>IPv4</EM> only.</P>"),
"net.ipv6.conf.all.forwarding" => _(
"<P>IP forwarding means to pass on network packets that have been received, but that are not destined for one of the system's configured network interfaces, e.g. network interface addresses.</P><P>If a system forwards network traffic on ISO/OSI layer 3, it is called a router. If you do not need that routing functionality, then disable this option.</P>"
) +
_("<P>This setting applies to <EM>IPv6</EM> only.</P>"),
"kernel.sysrq" => _(
"<P>Magic SysRq Keys enable some control over the system even if it crashes (e.g. during kernel debugging) or if the system does not respond.</P>"
),
"PERMISSION_SECURITY" => _(
"<P>There are predefined file permissions in /etc/permissions.* files. The most restrictive file permissions are defined 'secure' or 'paranoid' file.</P>"
),
"RUNLEVEL3_MANDATORY_SERVICES" => _(
"<P>Basic system services must be enabled to provide system consistency and to run the security-related services.</P>"
),
"RUNLEVEL5_MANDATORY_SERVICES" => _(
"<P>Basic system services must be enabled to provide system consistency and to run the security-related services.</P>"
),
"RUNLEVEL3_EXTRA_SERVICES" => _(
"<P>Every running service is a potential target of a security attack. Therefore it is recommended to turn off all services which are not used by the system.</P>"
),
"RUNLEVEL5_EXTRA_SERVICES" => _(
"<P>Every running service is a potential target of a security attack. Therefore it is recommended to turn off all services which are not used by the system.</P>"
)
}
end
|