IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
SET ADDITIONAL SECURITY CHECKS = ON
This parameter activates additional security checks which are incompatible
with earlier NDS versions.
The parameters listed above are absolutely mandatory for observance of the
security certification in accordance with class C2 and class F-C2/E2. The
parameters in the following can be used for extending the security functions.
SET CHECK EQUIVALENT TO ME = ON (Default=OFF)
This parameter forces checking of the NDS attribute "Equivalent To Me" on
the server. If the value for extended security is set to ON, the attributes
"Equivalence" and "Equivalent To Me" must be synchronised with the
DSREPAIR application. Activating this option may possibly have detrimental
effects on the system’s authentication speed.
SET NCP PACKET SIGNATURE = 3 (Default=1)
Communication between a Novell Netware client and a Novell Netware server
is controlled by the Netware Core Protocol (NCP). The client and server
exchange individual packets which contain data. A potential attacker can
monitor these packets by using special programs (see T 5.58 "Hacking Novell
Netware") and can manipulate packets belonging to users with higher
privileges.
The packet signature was developed to counteract this threat. When a user
logs on to the network, a secret key is determined. Whenever a workstation
then sends an inquiry to the network using NCP, it is provided with a
signature formed from the secret key and the signature of the previous packet.
This signature will be attached to the relevant packet and sent to the server.
The server will verify the packet signature before dealing with the actual
inquiry.
The packet signature can be activated on the server with this parameter. The
following NCP packet signature levels are possible:
0 = There are no NCP packet signatures.
1 = The Novell Netware server uses NCP packet signatures at the
request of the client.
2 = The Novell Netware server requires an NCP packet-signature from
the client. If the client cannot supply one, communication between
the client and the Novell Netware server is nonetheless allowed.
3 = The NCP packet signature is mandatory.
To guarantee security, the value for the NCP packet signature should be set to
3. The Novell Netware server and the client sotware on the workstations must
be configured accordingly. However, as use of the NCP packet signature
increases network load, it should be clarified beforehand whether performance
will be reduced unacceptably as a result.
SECURE CONSOLE
This command triggers several functions. It should therefore only be executed
on security-sensitive systems. The functions are:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000