Linux Security

SUSE Security Mission Statement

Security matters have gained more and more attention in the public over the last years. SUSE's presence in the software security field is continuously contributing to the high degree of trust and confidence that users value in Open Source Software.

the two sides of software security:

Software provides security features (such as non-standard authentication methods, encryption, data backup, and others), but it is also known to contain security weaknesses (such as design flaws, programming errors, and even backdoors). The SUSE Security Team traditionally addresses all of these aspects of software security, convinced that security work on software must never end. Software security is a process that must be filled with professional skills and permanent development on the software, rather than a state taken at some certain point in time. The resulting evolution is what has given SUSE, Linux and Open Source in general its excellent reputation in terms of security.

About security features:

A modern Linux Operating System such as the SUSE Linux Enterprise Server for enterprise use or the openSUSE distribution for home use feature a rich set of security programs and functions that range from access restrictions for your data, flexible and trustworthy authentication mechanisms, encryption for files and network connections, file integrity checking utilities, intrusion detection software, network analysis tools and monitoring/logging utilities for your system.
In addition to this, there are administration tools that help you to securely configure your system, and to securely download and install update packages from the SUSE Security Team. These utulities are standard in SUSE products. The update packages fix security bugs that have been found after your product has been made.
The security features of your Linux system are waiting for you to explore them. Take advantage them to further improve the level of privacy and security that is built into your system already by default!

About security bugs:

Programmers (usually) are human, and humans make mistakes. By consequence, all software contains errors. Some of these errors appear as instabilities (the software or the entire system crashes), while others do not have any apparent, visible effect. However, some software errors may introduce a security risk. A local or a remote attacker may be able to feed specially drafted data to the software which takes advantage of the programming error (in the case of a remotely exploitable bug, the data comes from an attached network such as a modem, etc.). The application then either crashes, resulting in a Denial of Service (DoS) attack, or it executes code that originates from the attacker, transferring control over the attacked resource to the attacker. Depending on the software's function in the system, the resulting security breach can impose little or high security risks for your data and your system, potentially giving an attacker the opportunity to delete, alter or even steal your data.

why open source software is more secure...

Several studies have been published that make an attempt to quantitatively compare commercial and OpenSource software with respect to security related error proneness. It is obvious that comparing the amount of security announcements or the amount of available security updates from commercial and Open Source Software vendors does not give any clear indication about the security condition of the software. It has been observed that entire Linux distributions (SUSE Linux 8.2 Professional comes with more than 3000 software packages, covering nearly all kinds of applications, tools and services) have been compared with commercial operating systems with some few software packages installed. Comparing the complexity of software packages is not useful either, unless software for a specific purpose is compared. Consequently, the resulting numbers do not have any significance.
The true strength of Open Source Software security lies in the nature of Open Source Software itself: Openness, transparency and traceability. Each package and each update package comes with its source code, along with the changes and their documentation. You can look at the source code and the changes added to it so see what the software does with your data.

You see if statements about the nature and severity of a (security related) bug have been falsified, belittled or simply concealed. A vendor's attempt to deceive the customer would be uncovered.
Open Source Software programmers take pride in their work. They fix bugs that users report and openly communicate, cooperate and compete with each other. They write their names into programs and documentation and gain a reputation over the time.
Open Source Software vendors cooperate with information about bugs (since the fixes are published along with the source code), especially security related errors.
By looking at the source code, you can make sure that the software does not keep any secrets from you. All software interfaces and program options are visible, all changes from update package to update package are precisely documented.
You can reproduce the vendor's work and build each package all by yourself. All needed tools and programs are contained in your product, the product has even been used to build itself. Effectively, this protects you against vendor-planted backdoors.
You can decide by yourself if something is a bug or a feature.

what does SUSE do for security?

The SUSE Security Team

responds to your emails that are directed to security@suse.de, the contact address of SUSE Security, following your demand for discretion and privacy. (contact details, email encryption keys)
helps to carefully select and configure the software used in SUSE products.
develops security tools and applications
is working on security projects such as the security certification of the SUSE Linux Enterprise Server 8
The SUSE Security Team regularly conducts source code audits of Open Source Software. A source code audit is a detailed in-depth analysis of the program text that the programmer wrote to implement the functions of the software. Source code security audits are by no means a new invention: SUSE's and many other teams and individuals have been conducting source code audits of Open Source Software for many years.
monitors security mailing lists for security related errors in software
maintains contact to software authors, individuals that specialize in software security and software security organizations (such as the CERT) to communicate and coordinate technical and organisational details about security related malfunctions in software.
provides solutions for software security breaches in the form of security updates
communicates the error and the availiability of security updates (update packages) in the form of SUSE Security Announcements.

what can i do for better security in my system?

Your SUSE System comes with a large variety of security functions in place, and with software that is installed and configured securely by default. However, there is always room for improvement, and there are things that you can do to help:

regularly run Yast Online Update (short: YOU). This program makes it easy for you and your SUSE system to be up-to-date with all available security update packages. These update packages have been made specifically for your system to seamlessly interoperate with all subsystems of your Linux installation. In a step-by-step manner, YOU selects all available update packages that are necessary for your system, it cryptographically verifies the package's integrity and authenticity (that it was was not altered by an external entity and that it originates from SUSE) after download and installs the package on your system, all with a few clicks. To use it, click on the "Online Update" item in the Yast2 Main Menu, or run the command "yast2 online_update" from a root shell.
YOU (Yast Online Update) Privacy:
YOU has been designed to protect and enhance the privacy and security aspects of your SUSE product. In order to achieve this goal with the best reliability, convenience and performance, YOU transmits data about your openSUSE installation to the SUSE webserver; the data is not passed on to any third party. The following list of data transmitted is complete:
- The exact product identification, such as "SUSE-Linux-DVD-i386-9.0-0 i686" (the release number, the architecture and the processor type)
- The timezone that is used by your system (this helps to chose the mirror that suits your needs best)
- A random cookie that is being transmitted with each request for the FTP server mirror list. The cookie is completely random and does not contain any encoded information about your system or other data. The cookie is used (exclusively by SUSE) to evaluate the acceptance of the YOU Yast Online Update tool.
- Starting with SUSE Linux 9.3, YOU does not use random data for the cookie value, but transmits a hash over gathered data from the system's hardware configuration. This sequence of numbers and letters is not random any more, but is specific to the system where YOU is running on, without the possibility of recovering information about the hardware in use. This allows for a statistical statement about whether a new installation on the same hardware has been performed, as opposed to the "System Update" function of the installer has been selected. See the script /usr/bin/machid_hash that is used by YOU to generate the value for the cookie, and the configuration file /etc/sysconfig/onlineupdate for more information and for choices if you disagree with the default settings.
YOU does not transmit any of the following data:
- Information about the package list that is installed on your system.
- Information about the processes running on your system.
- Any information whatsoever about the identity of a user who has a user account on your system or who may be logged on to your system.
- Usage data about files, programs and/or packages of your system.
The data contained in the requests to the server returning the YOU server list serves purely statistical purposes. Knowing more about the acceptance of our installation, update and systems management utilities is important to be able to proactively respond to the constantly changing expectations on behalf of the openSUSE user community, and to concentrate on working on those features accepted and used more widely than others (such as eg. the System Update versus the fresh installation function as a choice before installation).
The processing of the data gathered by YOU requests is done in full compliance with the mission statement. More concretely: We do not track user identities in the internet, the data is not combined with information from other sources, and the data is discarded as soon as not needed any more.
Please also read the SUSE Security mission statement below in this document.
Use the functionality that Yast2 provides to change the settings of your system. In particular the Security module helps you to configure security-relevant system settings with all possible ease of use.
Deactivate all services that you do not need. By default, the freshly installed system comes with all network services disabled, except for the ssh (secure shell) daemon that listens on port 22 to enable remote logins after the installation. Also, remove software that you do not need on servers.
Subscribe on SUSE's mailinglist suse-security-announce@suse.com and carefully read all SUSE Security Announcements. The list is open for posting only to the SUSE Security Team, and only official announcements are posted, resulting in very low traffic. Of course, your email address is subject to discretion and will not be passed on to third parties.
Use the principle of the least necessary privilege. Never work as root or another privileged user on your system unless it is necessary.
If you find a security related bug or another security related problem, make way for improvement and do not keep silent. Get loud, and you will be heard. Contact the SUSE Security Team, and if in doubt, contact other vendors as well.

SUSE security mission statement

SUSE Security is committed to delivering best effort security to its customers and to the Open Source community.
The primary objectives are to treat software security as a process that never ends. This implies to

promptly react to security incidents and deliver premium quality security updates.
continously improve the security related functionality in SUSE products.
continously contribute to the rapidly growing maturity of Open Source Software.
respect the Open Source Software security principles of openness, transparency and traceability.

The trust in Open Source Software security in general and the user's privacy in particular are indispensible and indefeasible.