Novell Netware 4.X Security Previous Screen Jeffrey L

84-10-20 Novell NetWare 4.X Security Previous screen Jeffrey L. Ott Payoff Novell's NetWare 4.X offers improved security features over previous NetWare releases. To capitalize on the strengths of 4.X, system and information security administrators must relearn how to manage the NetWare environment and the security of the information assets across the local area network. This article discusses the differences between NetWare 3.X and NetWare 4.X security and identifies the tools that security administrators will have at their disposal for securing the NetWare 4.X environment. Introduction The mid-1980s hosted a surge in the use of computer hardware and software in businesses worldwide. In many organizations, PCs were purchased for isolated departments without the guidance of corporate information systems departments. Soon, these isolated departments began to connect their PC workstations and common area printers together by using low-cost Network Operating System. Leading the network operating systems war was Novell's NetWare, which proved over time to be both efficient and cost effective. As departmental local area networks (LANs) grew, so did the need to incorporate these departmental LANs into other LANs within the organization. Although NetWare 3.X had become synonymous with the LAN network operating systems, it fell short of meeting the business requirements of the newly emerging client/server environment. From a system management perspective, NetWare 3.X lacked the ability to manage multiple servers from a single location. In response to this need, Novell released NetWare 4.X. This article discusses the differences between NetWare 3.X and NetWare 4.X security, and identifies the enhanced tools that security administrators will have at their disposal for securing the NetWare 4.X environment. The article also presents particularly sensitive areas of security concern for NetWare 4.X security administrators. Understanding Netware Security Basics The three fundamental components of information security are availability, confidentiality, and integrity. · Availability. The information system (i.e., the LAN, mainframe, mini, or attached network) must be available whenever it is needed. · Confidentiality. The information system and the data on the system must be available only to those who are authorized to use it. This requires the authentication of users who attempt to access the system and other measures, as needed, to limit users' access to only the information that they require for job-related duties. · Integrity. The information system and the data on that system must remain free from unauthorized, intentional (i.e., malicious and preplanned)and unintentional (i.e., accidental) modifications. These threats may come from within the organization or from outside the organization. Any information security program, application, and implementation must address these three fundamental components. Network Security Exposures and Risks Previous screen Many threats to information systems attack the hardware, software, and information on a system. Network hardware includes all of the physical pieces of the LAN, including the server, cables, wiring, telecom devices, routers, bridges, printers, and peripherals. Network software includes all of the applications, operating systems, and other programs executing on the network. Network information includes all of the information that resides on the LAN, such as application data, configuration parameters, and transmissions. Threats to a LAN include any intentional or unintentional destruction, modification, or disclosure of information. These threats range from the actions of hackers to industrial espionage and natural disasters. The most common disruptions of service occur as a result of mistakes made by employees. Security administrators should begin an analysis of the threats to the software and the information on the LAN by evaluating the physical security of the server. The server should be in a locked room, which will protect the equipment (e.g., the servers, tape backup devices, and media) from theft and from malicious use of the console. The console is the command center of a NetWare LAN; it is from the console that NetWare Loadable Modules (NLMs)are loaded. Anyone with access to the console has the ability to place NLMs on the system--many of which are malicious in nature, such as BURGLAR.NLM and SUPERPWD.NLM. The server should be connected to an uninterruptable power supply (UPS). An UPS will provide a window of time in which the system administrator can power down the server during an extended power outage. The UPS also cleans and filters electricity before it reaches the server, thus eliminating power surges, spikes, and brownouts. Netware Directory Services NetWare 4.X marks a radical change in NetWare security. The single most important change to NetWare is the introduction of NetWare Directory Services(NDS). NDS replaces the server-based Bindery of NetWare 3.X with a global, hierarchical, loosely consistent and replicated data base of all of the network resources and their associated properties. NDS enables NetWare 4.X to be an enterprisewide Network Operating System, because it allows NDS system administrators to create one flexible hierarchical directory for an entire network, and for an almost unlimited number of network resources. Implementation, administration, and management of NDS should be the first priority of the security administrator handling NetWare 4.X security. Exhibit 1 presents the security-related differences between NetWare 3.X and NetWare 4.X. Comparison of NetWare 3.X and 4.X Security Features Feature NetWare 3.X NetWare 4.X -------- ----------- ----------- Previous screen Maximum number of users connections per server 250 1,000 Object based naming service No Yes Single login to network No Yes RSA public/private key encryption No Yes Restrict login to specific Macintosh address No Yes NDS event auditing N/A Yes File system auditing No Yes Independent network auditor No Yes Independent network auditor password No Yes Audit user security transactions No Yes Audit supervisor transactions No Yes Audit file-creation statistics No Yes Audit directory creation statistics No Yes Audit volume statistics No Yes Filter transaction logs No Yes Transaction monitoring and auto log updates No Yes Multiple auditors No Yes Remote console session security No Yes Remote console modem callback No Yes Network supervisor Yes Yes Workgroup manager Yes Yes User account manager Yes Yes File server console operator Yes Yes Determine who has console and supervisor privileges No Yes Audit trail name service events No Yes Governmental C-2 level security certification No Yes An NDS directory is typically illustrated as an upside-down tree, with the roots at the top and the branches and leaves at the bottom. This representation of the NDS architecture should help security administrators to conceptualize the layout of a NetWare 4.X network. Exhibit 2 presents a basic NDS directory tree structure. Security rights in the Previous screen NDS structure flow down: if a user has access at a higher level in the NDS directory tree, the user will generally have access to branches and leaves beneath the permitted level. NDS Directory Tree NetWare Directory Services Objects The NDS data base is comprised of objects. NDS objects are not physical objects; they are object representations and the object's associated properties. This allows the physical object (e.g., the user, server, or device) to be physically removed from the server where the NDS resides. This treatment differs from the Bindery treatment of network objects in previous releases of NetWare, in which the Bindery was aware of only those objects that were directly attached to its server. The NDS structure facilitates the management of an enterprisewide network. For example, the administrator does not need to know the address or location of a printer to permit a group of users access to that printer, nor must the administrator create new logon IDs for these users for the printer s server. Instead, the administrator provides access to the requested printer to the group, even if the printer is a continent away. Each NDS object has a set of properties, and each object property has associated property values. For example, the user object's associated properties include name, other name, description, location, and telephone number. The data entered for each of those properties are the property values. There are three basic types of objects in an NDS directory: · Physical objects (e.g., users, servers, and printers). · Logical objects (e.g., user groups, queues, and partitions) · Other objects (managerial objects that help organize the other objects in the NDS directory tree, such as Organization and Organizational Unit objects.) There are also three different classifications of objects: · Root object. · Container object. · Leaf object. Root Object. When NetWare is installed, the root is placed at the top of the directory tree. The root cannot be renamed or removed, and is always designated with brackets (i.e., [Root]). Container Objects. When NetWare 4.X is installed, one container object is created. Container objects form the next part of the directory tree after the root. A container holds other objects, which must be other container objects or leaf objects. The container object provides a means to organize a directory logically. Within container objects are two further classifications: · Organization. This organization (O) classification

Load more