281
CHAPTER 11
Managing Ubuntu Server
Security
Configuring Cryptography and
AppArmor
U
buntu Server offers some powerful security options. In this chapter you’ll learn how
to set up two important security solutions. First, you’ll learn how to create and manage
a PKI environment and certificate authority, using OpenSSL cryptography. Next, you’ll
be introduced to AppArmor, a new feature in Ubuntu Server 8.04 that helps you to secure
individual applications.
Managing Cryptography
In the age of the Internet, cryptography has become increasingly important. When data is
sent across insecure networks, you need to make sure the data is protected. When com-
municating with a host on the other side of the world, you need to make sure that the
host really is the host you think it is (authentication). To do this, cryptography can help.
In this section you will learn how to use OpenSSL to implement a secure cryptographic
infrastructure. The following subjects are discussed:
 s )NTRODUCTIONTO33,
 s 0UBLICANDPRIVATEKEYS
 s 4HENEEDFORACERTIFICATEAUTHORITY
 s #REATINGACERTIFICATEAUTHORITYANDSERVERCERTIFICATES
CHAPTER 11
N
MANAGING UBUNTU SERVER SECURITY
282
Introduction to SSL
Before Netscape invented the Secure Sockets Layer (SSL) protocol in 1994, there was no
good way to protect data against the eyes of interceptors when the data traveled across
the Internet. With SSL, data can be encrypted and clients and servers can be authenti-

CHAPTER 11
N
MANAGING UBUNTU SERVER SECURITY
283
The Need for a Certificate Authority
The scenario described in the preceding section is realistic and works well, but there is
one problem: when Linda receives Kylie’s public key, how can she be sure that it is Kylie’s
public key and not the public key of someone pretending to be Kylie? That’s where the
CERTIFICATEAUTHORITY#!COMESIN!#!GUARANTEESTHEAUTHENTICITYOFPUBLICKEYSOF
users and servers. It does so by signing this public key with its own private key. The result
of this is a public key certificate in which the public key of the user is present, together
WITHTHESIGNATUREOFTHE#!4HEUSERAPPLICATIONWHICHSHOULDHAVEACOPYOFTHEPUBLIC
KEYOFTHE#!CANVERIFYAUTOMATICALLYTHATTHESIGNATUREISVALIDANDTHEREFORECANUSE
this guaranteed public key certificate without consulting the user. If on the other hand
ACERTIFICATEISSIGNEDBYA#!OFWHICHTHEPUBLICKEYISUNKNOWNONTHELOCALHOSTTHE
user application notifies the user about the issue and allows the user to decide what to do
with that certificate. Of course, the user can decide to trust that the public key in the cer-
tificate is authentic, but there is no way to guarantee that.
4HEMAINPURPOSEOFA#!ISTOGUARANTEETHEAUTHENTICITYOFAPUBLICKEYBUTWHOIN
THISCASEISTHERETOGUARANTEETHEAUTHENTICITYOFTHE#!4HISISWHERETHETRUSTEDROOT
COMESIN'ENERALLYSPEAKINGTHEREARETWODIFFERENTKINDSOF#!S
sLocal CAs#!STHATrun within a company and are used to create certificates for
keys of individual servers.
sTrusted root CAs#!Sthat are trusted by everyone and used to create keys for
OTHER#!S)NOTHERWORDSTHETRUSTEDROOTISA#!THATGUARANTEESTHEAUTHENTICITY
OFOTHER#!S
The reason the trusted root is trusted is that most applications already have the pub-
LICKEYOFSUCHATRUSTEDROOT#!BYDEFAULT4HEREFORETHEAPPLICATIONSWILLAUTOMATICALLY
accept the certificate signed by such a trusted root. It is, however, not necessary for every
USERTOGOTOTHETRUSTEDROOTDIRECTLYWITHINACOMPANYYOUCANCREATEYOUROWN#!

and it doesn’t need a network connection to do so.
Creating a Certificate Authority and Server Certificates
To CREATEA#!ANDCERTIFICATESON5BUNTU3ERVERYOUCANUSETHE
klajooh
command.
In this section you’ll learn how to use the
klajooh
command to create a certificate and
ASELFSIGNED#!"ECAUSETHESELFSIGNED#!ISTHEHIGHESTLEVELINTHE#!HIERARCHYINTHIS
EXAMPLEITWILLBEAROOT#!
The following steps explain how to proceed:
1. Decide where you want to create the directory structure in which you want to
PUTTHE#!4HISSHOULDBEADIRECTORYSTRUCTURETHATCANTBEACCESSEDBYOTHER
users. The home directory of the user
nkkp
, for example, might be a good location,
because no ordinary users have access to this directory. From the directory of your
choice, start with
ig`ennkkp)?=
TOCREATEASUBDIRECTORYINWHICHTHE#!WILLSTORE
its files.
2. Next, some subdirectories must be created in this
nkkp)?=
directory. The names of
these subdirectories are predefined in the configuration file
+ap_+ooh+klajooh*_jb
,
so don’t try anything creative unless you are willing to change all settings in this
configuration file as well. The command
ig`en_anpojas_anpolner]pa_nh

modifying the
DKIA
and
`en
variables. Also, it is a good idea to set the names of the
certificates to the correct value. Listing 11-1 shows an example of what this should
look like. All nonessential parameters have been omitted from the listing.
Listing 11-1. Some Important Settings from openssl.cnf
DKIA9+nkkp+nkkp)?=
`en9+nkkp+nkkp)?=
***
_anpebe_]pa9 `en+_]_anp*lai
***
lner]pa[gau9 `en+lner]pa+lnergau*lai
***
4. Now that you have properly tuned the configuration file, you can create
ASELFSIGNEDCERTIFICATEFORTHEROOT#!4HEFOLLOWINGCOMMANDCREATESTHECER
TIFICATEWITHABIT23!KEYTHATISVALIDFORYEARS
klajoohnam)jasgauno]6-,.0)t1,5)`]uo/21,)gaukqp
±
lner]pa+lnergau*lai)kqp_]_anp*lai
The main command used here is
klajooh
. This command has several parameters
that can be used as if they were independent commands. The parameter
nam
is
used to create the self- signed certificate (check its man page to see everything
it can be used for). To make clear where these keys should be created,
)gaukqp

ejpkukqn_anpebe_]panamqaop*
Sd]pukq]na]^kqppkajpaneosd]peo_]hha`]@eopejcqeoda`J]iakn]@J*
Pdana]namqepa]basbeah`o^qpukq_]jha]raokia^h]jg
Bknokiabeah`opdanasehh^a]`ab]qhpr]hqa(
Ebukqajpan#*#(pdabeah`sehh^ahabp^h]jg*
)))))
?kqjpnuJ]ia$.happan_k`a%W=QY6JH
Op]paknLnkrej_aJ]ia$bqhhj]ia%WOkia)Op]paY6
Hk_]hepuJ]ia$ac(_epu%WY6
Knc]jev]pekjJ]ia$ac(_kil]ju%WEjpanjapSe`cepoLpuHp`Y6
Knc]jev]pekj]hQjepJ]ia$ac(oa_pekj%WY6
?kiikjJ]ia$ac(UKQNj]ia%WY6Iuoahb
Ai]eh=``naooWY6iuoahb<at]ilha*_ki
N
Note
You should always check the output of the
klajooh
commands carefully. It’s not easy to see errors,
but it is easy to make them through small typing mistakes. You should fix all errors before proceeding to the
next step.
CHAPTER 11
N
MANAGING UBUNTU SERVER SECURITY
287
6. 9OUNOWHAVEYOUROWNROOT#!WHICHMEANSYOUCANCREATEYOUROWNCERTIFI-
cates, used for any purpose. For example, you can create server certificates for
secure e-mail or create client certificates to connect a notebook to a VPN gate-
way. Before you can start creating your own certificates, you need to create the
OpenSSL database. This database consists of two files in which OpenSSL keeps
track of all the certificates that it has issued; you need to create these two files

******************''''''
*************''''''
snepejcjaslner]pagaupk#lner]pa+i]ehoanrangau*lai#
AjpanLAIl]ooldn]oa6
Ranebuejc)AjpanLAIl]ooldn]oa6
)))))
Ukq]na]^kqppk^a]oga`pkajpanejbkni]pekjpd]psehh^aej_knlkn]pa`
ejpkukqn_anpebe_]panamqaop*
Sd]pukq]na]^kqppkajpaneosd]peo_]hha`]@eopejcqeoda`J]iakn]@J*
Pdana]namqepa]basbeah`o^qpukq_]jha]raokia^h]jg
Bknokiabeah`opdanasehh^a]`ab]qhpr]hqa(
Ebukqajpan#*#(pdabeah`sehh^ahabp^h]jg*
)))))
CHAPTER 11
N
MANAGING UBUNTU SERVER SECURITY
288
?kqjpnuJ]ia$.happan_k`a%W=QY6JH
Op]paknLnkrej_aJ]ia$bqhhj]ia%WOkia)Op]paY6J>
Hk_]hepuJ]ia$ac(_epu%WY6=iopan`]i
Knc]jev]pekjJ]ia$ac(_kil]ju%WEjpanjapSe`cepoLpuHp`Y6Okia?kil]ju
Knc]jev]pekj]hQjepJ]ia$ac(oa_pekj%WY6okiasdana
?kiikjJ]ia$ac(UKQNj]ia%WY6Ia
Ai]eh=``naooWY6ia<okia_kil]ju*_ki
Lha]oaajpanpdabkhhksejc#atpn]#]ppne^qpao
pk^aoajpsepdukqn_anpebe_]panamqaop
=_d]hhajcal]ooskn`WY6
=jklpekj]h_kil]juj]iaWY6
8. You NOWHAVECREATEDTHE#!ANDAKEYPAIRTHATYOUWANTTOGETSIGNED)FUNLIKE
INTHISSIMPLEEXAMPLESETUPTHE#!THATNEEDSTOSIGNTHEKEYDOESNOTRUNON

be created without any problem. Listing 11-4 shows the output that is generated
when signing this certificate.
Listing 11-4. Signing the Certificate Just Created
nkkp<iah6z+nkkp)?=klajooh_])lkhe_ulkhe_u[]jupdejc)jkpatp)kqp
±
_anpo+i]ehoanran_anp*lai)ejbehao_anpo+i]ehoanran[nam*lai
Qoejc_kjbecqn]pekjbnki+qon+he^+ooh+klajooh*_jb
Ajpanl]ooldn]oabkn+nkkp+nkkp)?=+lner]pa+lnergau*lai6