IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
consideration before using these clients, though. For example, Netscape
Communicator is not able to grant access to LDAP servers which require a
user name and a password. LDAP Services for NDS therefore recognises a
user who uses this browser as a client as an anonymous user, and by default
makes him a trustee of [Public], which typically comprises only a browse right
for NDS. If additional rights are required, a proxy user must be set up who has
the corresponding NDS rights. As well as this, the proxy user feature must
also be enabled in the LDAP group object.
As LDAP Services for NDS is fully integrated into NDS, an extension of the
NDS scheme must be set up at the time of installation. This can only be done
via an account with supervisor rights for the [Root] object. During installation
of the first LDAP server in an NDS tree, the database scheme of NDS is
extended so as to make two new NDS objects LDAP Server and LDAP Group
available. LDAP Services for NDS is configured with the aid of these two
objects. If additional LDAP servers are installed in this NDS tree, it is not
necessary to install the scheme extension again because NDS already has the
current database scheme.
The configuration of LDAP Services for NDS is stipulated in the properties of
the two objects, LDAP Server and LDAP Group. The settings must be made in
accordance with the security strategy that has been devised. Some of the
properties that are particularly relevant to the security of the system are
examined below.
Log file size limit (LDAP Server object)
This property can be used to set the maximum size of the log file specified in
the Log filename property. When the log file reaches the size specified here,
the information in the Log filename file is copied to the file specified under
Backup log file. All new log data is written to the Log filename file.
Default: 1.000.000
Minimum: 0 (unlimited file size)
Maximum: 4.294.967.295
If the size is set to zero, there is no size limit for the log file. In this case the
file should not be stored on the SYS volume because the file is liable to grow
to such an extent that the available storage space on the volume will be fully
taken up. Inconsistencies within the NDS may occur as a result, and the
availability of the server is reduced.
In the LDAP Group object the following properties are particularly relevant to
security:
Suffix
The Suffix box is where the subtree is defined that is made available to the
LDAP clients. If this box is blank, the clients are granted access to the entire
NDS tree, in other words from the [Root] object. If a client sends a request to
the server relating to an object outside the defined subtree, an error is returned,
unless a value is entered in the Referral box.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000