IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.103 DHCP server under Novell Netware 4.x
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Setting up TCP/IP protocols involves considerable effort if the IP address, the
subnetwork mask, the default gateway etc. have to be assigned manually for
each workstation. If it is intended to change only the default gateway entry in
a particular segment, for example, this requires a great deal of work and also
increases the risk of incorrect inputs being made. These tasks can be
centralised and automated through the use of a DHCP (Dynamic Host
Configuration Protocol) server.
In order to ensure reliable handling of the DHCP server from Novell Netware
4.x, it is necessary to know the structure of the TCP/IP network whose
addresses are to be administered with the aid of the DHCP server. The
important features here, apart from the address class (TCP/IP network class A
- C), are also the subnet masks that are used and the addresses of the default
gateways, so as to allow cross-segment data traffic on the basis of TCP/IP.
The following sections examine certain aspects relating to the configuration of
the DHCP service under Novell Netware 4.x that are of particular relevance to
the security of the system as a whole.
Configuration of TCP/IP segments
The TCP/IP segments that are to be managed by the server are defined using
the SUBNETWORK PROFILE option. Values such as the subnetwork name,
address range and type of assigment are read out automatically from the
configuration menu of the DHCP server when it is started up. If the DHCP
server is supposed to take care of several IP segments, it is advisable to delete
the values that are read in automatically and to replace them with
"meaningful", manually configured values. For example, if "3CX9_1_EII" is
read out as the subnetwork name, it is easier for troubleshooting and for
subsequent configuration work on that segment if this entry is replaced
manually by an entry that describes the segment better, such as the name
"EthernetII". It is also possible to use other descriptive naming conventions,
which designate a segment according to its topological arrangement, for
example (Building A, 2nd floor or Management).
Automatic assignment of IP addresses
One of the key services of the DHCP server is the automatic assignment of IP
addresses. The AUTOMATIC IP ADDRESS ASSIGNMENT parameter
identifies the address range from which the DHCP server dynamically
distributes the addresses to the network nodes that request an address. This
range should be chosen such that the addresses for servers, printers and routers
are not included within the range of dynamic allocation. The general rule is
that servers, printers, routers and the network nodes with dynamic address
assignment should be assigned clearly distinguishable IP address ranges. This
ensures that it is obvious from the address range alone which type a network
node belongs to, if problems arise in the IP area.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000