Introduction to Securing openSUSE Servers
openSUSE is a robust, enterprise-grade Linux distribution widely used for servers, development environments, and production workloads. Whether you are running openSUSE Leap for stability or Tumbleweed for cutting-edge packages, securing your server is a non-negotiable responsibility. A compromised server can lead to data breaches, service disruption, and lateral movement across your entire infrastructure.
This tutorial provides a practical, hands-on checklist for hardening openSUSE servers. It covers what server hardening is, why it matters, and walks through concrete steps you can apply immediately. Each section includes real commands and configuration examples tailored specifically for openSUSE.
What Is Server Hardening?
Server hardening is the process of reducing a system's attack surface by configuring it securely, disabling unnecessary services, enforcing strong access controls, and applying patches. The goal is to minimize vulnerabilities while maintaining functionality.
Why It Matters
- Reduced attack surface: Fewer running services mean fewer exploitable entry points.
- Compliance: Many regulations (GDPR, HIPAA, PCI-DSS) require documented hardening.
- Breach containment: Proper hardening limits the damage an attacker can do even if they gain access.
- Operational stability: Secure systems tend to be more predictable and easier to audit.
Initial System Hardening
Update the System
Before applying any hardening, ensure your system is fully patched. openSUSE uses zypper as its package manager.
# Refresh repositories and apply all patches
sudo zypper refresh
sudo zypper update
# Apply security-only patches
sudo zypper patch --category security
# Check for needed reboots
sudo zypper ps -s
Install Essential Security Tools
# Install baseline security utilities
sudo zypper install -t pattern security
# Install additional hardening and audit tools
sudo zypper install fail2ban firewalld audit lynis clamav rkhunter
Configure Automatic Updates
For openSUSE Leap, you can enable automatic security patching using zypper-automatic.
sudo zypper install zypper-automatic
sudo systemctl enable --now zypper-automatic.timer
# Verify the timer is active
systemctl status zypper-automatic.timer
Edit /etc/sysconfig/zypper-automatic to control behavior:
# Apply only security updates automatically
ZYPP_AUTO_UPDATE="0"
ZYPP_AUTO_PATCH="1"
ZYPP_AUTO_PATCH_CATEGORY="security"
User and Access Management
Disable Root Login Over SSH
Direct root login is a major risk. Instead, use a regular user with sudo privileges.
# Create an admin user
sudo useradd -m -G wheel adminuser
sudo passwd adminuser
# Ensure the wheel group can use sudo
sudo visudo
Uncomment or add the following line in visudo:
%wheel ALL=(ALL) ALL
Enforce Strong Password Policies
openSUSE uses PAM for authentication. Configure password quality with pam_pwquality.
sudo zypper install pam_pwquality
Edit /etc/security/pwquality.conf:
minlen = 12
minclass = 4
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
maxrepeat = 3
enforce_for_root
Set password aging policies in /etc/login.defs:
PASS_MAX_DAYS 90
PASS_MIN_DAYS 7
PASS_WARN_AGE 14
Lock Unused Accounts
# List all users
cut -d: -f1 /etc/passwd
# Lock a specific account
sudo usermod -L username
# Set account expiry
sudo chage -E 2025-12-31 username
# View account aging info
sudo chage -l username
SSH Hardening
SSH is the primary remote access method for most servers and a frequent attack target. Hardening it is critical.
Configure SSHD Securely
Edit /etc/ssh/sshd_config:
# Disable root login
PermitRootLogin no
# Disable password authentication (use keys only)
PasswordAuthentication no
PubkeyAuthentication yes
# Limit to specific users or groups
AllowUsers adminuser
AllowGroups wheel
# Reduce login grace period
LoginGraceTime 30
# Limit authentication attempts
MaxAuthTries 3
# Disable X11 forwarding if not needed
X11Forwarding no
# Use strong ciphers and MACs
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
# Disable empty passwords
PermitEmptyPasswords no
# Use a non-default port (optional but reduces noise)
Port 2222
Restart SSH after changes:
sudo systemctl restart sshd
sudo systemctl status sshd
Set Up SSH Key Authentication
# On your local machine, generate an Ed25519 key
ssh-keygen -t ed25519 -C "adminuser@workstation" -f ~/.ssh/opensuse_admin
# Copy the key to the server
ssh-copy-id -i ~/.ssh/opensuse_admin.pub adminuser@server-ip
# Test the connection
ssh -i ~/.ssh/opensuse_admin adminuser@server-ip
Install and Configure Fail2ban
Fail2ban monitors logs and bans IPs that show malicious signs, such as too many failed SSH login attempts.
sudo zypper install fail2ban
sudo systemctl enable --now fail2ban
Create a local configuration at /etc/fail2ban/jail.local:
[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
backend = systemd
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
Firewall Configuration with firewalld
openSUSE ships with firewalld as the default firewall management tool. It provides a zone-based approach to network security.
Enable and Start firewalld
sudo zypper install firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --state
Configure Zones and Rules
# Set the default zone to public
sudo firewall-cmd --set-default-zone=public
# Allow only SSH (on custom port if configured) and HTTP/HTTPS
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
# Remove unnecessary services
sudo firewall-cmd --permanent --remove-service=dhcpv6-client
# Reload to apply changes
sudo firewall-cmd --reload
# Verify the configuration
sudo firewall-cmd --list-all
Rate Limiting SSH Connections
# Limit new SSH connections to 3 per minute
sudo firewall-cmd --permanent --add-rich-rule='rule port port=2222 protocol=tcp limit value=3/m accept'
sudo firewall-cmd --reload
Mandatory Access Control with AppArmor
openSUSE supports AppArmor for mandatory access control (MAC). It confines individual programs to a set of listed files and capabilities, limiting the damage from a compromised application.
Enable AppArmor
# Install AppArmor
sudo zypper install apparmor apparmor-utils apparmor-parser
# Enable and start the service
sudo systemctl enable --now apparmor
# Verify AppArmor is running
sudo aa-status
Configure AppArmor Profiles
# List loaded profiles
sudo aa-status
# Put a profile into enforce mode
sudo aa-enforce /etc/apparmor.d/usr.sbin.mysqld
# Put a profile into complain mode (logs only, useful for testing)
sudo aa-complain /etc/apparmor.d/usr.sbin.nginx
# Generate a new profile for an application
sudo aa-genprof /usr/bin/myapp
Ensure AppArmor loads at boot by editing /etc/default/apparmor:
APPARMOR_ENABLE=yes
Package Management and Update Hygiene
Manage Repositories Securely
# List configured repositories
sudo zypper lr -u
# Remove untrusted or unnecessary repos
sudo zypper rr repository-name
# Add the official security repository (if not present)
sudo zypper ar -f https://download.opensuse.org/update/leap/15.5/security security-updates
Verify Package Integrity
openSUSE signs packages with GPG keys. Ensure verification is enabled:
# Verify GPG keys are imported
sudo zypper --gpg-auto-import-keys refresh
# Manually verify a package signature
rpm --checksig /var/cache/zypp/packages/*/some-package.rpm
Audit Installed Packages
# List all installed packages
zypper se --installed-only
# Find packages with no repository (orphaned)
zypper packages --orphaned
# Remove unneeded packages
sudo zypper remove --clean-deps orphaned-package
Service Management and Attack Surface Reduction
Disable Unnecessary Services
# List all enabled services
systemctl list-unit-files --type=service --state=enabled
# Disable services you do not need
sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now cups
sudo systemctl disable --now postfix
# Mask a service to prevent it from being started manually
sudo systemctl mask rpcbind
Remove Unnecessary Software
# Remove compilers and debugging tools from production servers
sudo zypper remove gcc gcc-c++ make gdb
# Remove network utilities that attackers can abuse
sudo zypper remove telnet rsh-server ypserv tftp
Logging, Auditing, and Monitoring
Configure the Audit Daemon
The Linux Audit system provides detailed logging of security-relevant events.
sudo zypper install audit
sudo systemctl enable --now auditd
Add audit rules in /etc/audit/rules.d/audit.rules:
# Monitor failed login attempts
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
# Monitor changes to passwd and shadow files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
# Monitor sudoers changes
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
# Monitor SSH configuration changes
-w /etc/ssh/sshd_config -p wa -k ssh_config
# Watch for system time changes
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
# Reload audit rules
sudo augenrules --load
# View audit logs
sudo ausearch -k identity
sudo aureport --summary
Centralize Logs with rsyslog
For production servers, forward logs to a central logging server to prevent tampering.
# Edit /etc/rsyslog.conf or create /etc/rsyslog.d/remote.conf
*.* @@logserver.example.com:6514
Use TCP (double @@) for reliability and configure TLS for encryption.
Run Lynis for Security Auditing
sudo lynis audit system
# View the report
sudo cat /var/log/lynis.log | grep -i warning
sudo cat /var/log/lynis-report.dat | grep suggestion
Network Security
Disable Unused Network Protocols
Disable IPv6 if you are not using it, and block unused protocols in /etc/sysctl.conf:
# IPv6 settings
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
# Prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable IP forwarding (unless this is a router)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
# Ignore bogus ICMP responses
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Enable reverse path filtering
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Log martian packets
net.ipv4.conf.all.log_martians = 1
# Enable TCP SYN cookies
net.ipv4.tcp_syncookies = 1
Apply the changes:
sudo sysctl -p
Secure Time Synchronization
sudo zypper install chrony
sudo systemctl enable --now chronyd
# Verify synchronization
chronyc sources
chronyc tracking
Edit /etc/chrony.conf to use trusted NTP servers:
server ntp1.example.com iburst
server ntp2.example.com iburst
File System Security
Set Secure Mount Options
For partitions like /tmp, /var/tmp, and /home, use mount options that prevent execution of binaries and device access.
Edit /etc/fstab:
tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,mode=1777 0 0
tmpfs /var/tmp tmpfs defaults,nodev,nosuid,noexec,mode=1777 0 0
/dev/sda3 /home ext4 defaults,nodev,nosuid 0 2
# Remount without rebooting
sudo mount -o remount /tmp
sudo mount -o remount /home
# Verify mount options
mount | grep -E "tmp|home"
Set restrictive umask
Edit /etc/profile and /etc/bash.bashrc:
umask 027
Find World-Writable Files
# Find world-writable files (excluding symlinks)
sudo find / -xdev -type f -perm -0002 -print
# Find SUID and SGID binaries
sudo find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \;
# Find files with no owner
sudo find / -xdev -nouser -o -nogroup -print
Kernel and Boot Security
Secure the Bootloader
openSUSE uses GRUB2. Set a password to prevent unauthorized boot parameter changes.
# Generate a GRUB password hash
sudo grub2-mkpasswd-pbkdf2
# Edit /etc/grub.d/40_custom
set superusers="adminuser"
password_pbkdf2 adminuser grub.pbkdf2.sha512.10000.HASH_HERE
# Regenerate the GRUB configuration
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
Enable Kernel Hardening Options
Install and configure kernel-hardening options. openSUSE supports kexec restrictions and kernel module signing.
# Disable kexec (prevents kernel replacement at runtime)
echo 1 | sudo tee /proc/sys/kernel/kexec_load_disabled
# Restrict kernel dmesg access
echo 1 | sudo tee /proc/sys/kernel/dmesg_restrict
# Restrict kernel pointer access
echo 1 | sudo tee /proc/sys/kernel/kptr_restrict
# Restrict access to kernel logs
echo 1 | sudo tee /proc/sys/kernel/perf_event_paranoid
Add these to /etc/sysctl.conf for persistence:
kernel.kexec_load_disabled = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.perf_event_paranoid = 2
Best Practices
- Principle of least privilege: Grant users and services only the permissions they absolutely need. Use dedicated service accounts with minimal access.
- Defense in depth: Never rely on a single security control. Combine firewalls, AppArmor, fail2ban, and strong authentication.
- Regular audits: Run Lynis and auditd reports weekly. Review failed login attempts and unusual activity patterns.
- Backup before changes: Always snapshot or back up your server before applying hardening changes, especially to SSH and firewall configurations.
- Test in staging: Validate hardening steps on a non-production server first. Some settings (like disabling IPv6 or changing SSH ports) can break services.
- Document everything: Maintain a configuration management repository (Ansible, Salt) with your hardening playbooks. openSUSE integrates well with SaltStack.
- Monitor continuously: Set up alerts for security events. Tools like Wazuh, OSSEC, or a simple logwatch cron job can notify you of anomalies.
- Keep an inventory: Track installed software, open ports, and running services. Re-audit whenever you deploy new applications.
- Use encryption at rest: Enable LUKS for disk encryption on sensitive servers, and use TLS for all network communication.
- Plan for incident response: Have a documented procedure for what to do if a breach is detected, including how to isolate the server and preserve forensic evidence.
Conclusion
Securing an openSUSE server is an ongoing process, not a one-time task. By following this practical checklist, you significantly reduce your attack surface through systematic hardening of users, SSH, firewalls, AppArmor, packages, services, logging, network settings, and the file system. The key is to apply changes incrementally, test thoroughly, and maintain documentation so your security posture remains consistent across deployments. Combine these technical controls with regular audits, continuous monitoring, and a clear incident response plan to build a resilient server infrastructure that can withstand the evolving threat landscape.