applications and keep them from performing unnecessary file or directory accesses
and this helps to make sure that every profiled application just does what it was
designed to and not become a security risk itself. For more details on AppArmor
usage on SUSE Linux Enterprise Point of Service, refer to Section 8.4, “Application
Security” (page 115).
8.1 Physical Server Security
Your instance of SUSE Linux Enterprise Point of Service is set up in a highly secure
corporate environment (using third-party security solutions and various other security
measures), but you still need to make sure that nobody gains unauthorized physical
access to your severs and can log in to them to tamper with your setups.
The following list provides a few basic security-related things you should bear in mind
when creating your setup:
• Keep your severs in a separate server room that is accessible to only a few selected
people or ideally just you.
• Separate your server room from the rest of your IT setup by requiring some sort of
authentication before people can enter the room. Use any of the following: key
cards, key codes, PIN numbers, finger print authentication, etc.
• Use BIOS and boot loader passwords to prevent anyone from manipulating the
boot process of your servers.
8.2 Network Security
Even if your SUSE Linux Enterprise Point of Service network is secured against the
Internet (using third-party security solutions and firewalls), secure your severs against
unauthorized access from the inside:
• All servers should just allow (console) access by one account, by
root
, alone.
• Create one single user account through YaST, namely the
root
account.
112
SUSE Linux Enterprise Point of Service Guide
