Novell iManager 2.7.5 Administration Guide - NetIQ

A.3 iManager Authorized Users and Groups
Authorized Users and Groups are those that iManager permits to perform its various administrative
tasks. For more information about specifying and configuring Authorized Users and Groups, see
“Authorized Users and Groups” on page 70.
Authorized Users and Groups data is stored in the configiman.properties file, which must be
secured to prevent unauthorized modification. To do this, modify the access controls for
configman.properties to restrict those users authorized to manually edit the file.
NOTE: Not specifying an Authorized User or Group, which prevents the configiman.properties
file from being created, or specifying an Authorized User or Group of AllUsers, allows any user to
install iManager plug‐ins and modify iManager server settings. This is a security risk for server‐based
iManager environments.
A.4 Preventing User Name Discovery
In some installations, the eDirectory server is protected behind a firewall, but the iManager server is
open to the outside world to allow management from home or on the road. Access to iManager is
controlled with Username, Password, and Treename fields on the login screen. In such installations, it is
often desirable to tighten security to avoid revealing any information about the system.
Standard iManager configurations pass through eDirectory messages related to invalid user names
and passwords during iManager authentication. These messages can inadvertently provide too much
information to potential crackers. To avoid this, iManager 2.7 includes a configuration option to hide
the specific reason for login failure. When enabled, the following error messages are replaced with a
generic error message that reads: Login Failure. Invalid Username or Password.
• Invalid Username (‐601)
• Incorrect password (‐669)
• Expired password or disabled account (‐220)
To enable this setting, open the Configure view and select iManager Server > Configure iManager. On the
Authentication tab, select Hide specific reason for login failure. This sets
Authenticate.Form.HideLoginFailReason=true in iManager’s config.xml file.
Additionally, iManager 2.7 does not support the asterisk (*) character as a wildcard in the Username
field. This prevents unauthorized users from discovering valid user names. It also prevents possible
denial‐of‐service attacks that attempt to overload the eDirectory server by continually attempting a
login using only the wildcard (*), which forces eDirectory to search for and return all matching user
names.
A.5 Tomcat Settings
Because iManager makes use of Tomcat Servlet Container, iManager administrators should be aware
of the encryption‐related configuration options of those resources as part of their overall security
strategy. Of particular interest are cipher suites and trusted certificates, which directly impact the
quality of your wire‐level encryption. Consider the following rules when configuring your Tomcat
environment:
• Do not use SSL 2.0 cipher suites, which are outdated and not guaranteed to be secure.
iManager Security Issues 113