• Do not export or import any file systems on these servers, i.e. do not allow NFS or
Samba shares on your servers.
SUSE Linux Enterprise Point of Service itself provides some security against data
manipulation via the network:
• LDAP-related network traffic can be configured via secure SSL/TLS channels.
• Image data is exchanged between servers via rsync and md5sums are calculated
and checked to provide data integrity.
8.3 Data Security
The most vital data of your SUSE Linux Enterprise Point of Service setup is stored in
the LDAP directory on the Administration Server. Whoever gains control over this
setup data can manipulate the setup of any server or terminal in your setup. Therefore,
limit the list of users with access to the LDAP directory to the bare minimum and make
sure they obtain the least possible privileges only. Use LDAP Access Control Lists
(ACL) as part of the LDAP server configuration to restrict access to your LDAP data.
The configuration of your OpenLDAP server is located under
/etc/openldap/
slapd.conf
. For more information on how this configuration file is generated and
maintained, refer to Section B.3.3, “posInitAdminserver.sh” (page 210).
ACLs allow you to specify separate access controls to different parts of the configuration.
You can create different ACLs for user password data, server configuration data, and
configuration of different locations and so forth.
Before creating ACLs, perform an analysis of users and privileges needed to run your
configuration. These may depend on the type of setup you have chosen and may vary.
As an example, let us assume you run the following setup:
• A central Administration Server managed by the global administrator role.
• Independent Branch Servers managed by local administrators.
Thus, you need to make sure that both your user configuration on the Administration
Server and the ACLs in the LDAP server configuration reflect these roles and provide
suitable privileges to these user roles without providing too many privileges.
Securing Your Setup
113
