IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 2.42 Complexity of the NDS
NDS (Netware Directory Services) allows the installation of a shared,
decentralised directory database of all logical and physical resources within a
network. Each network resource is represented by a unique entry in this
database, regardless of the actual location of the resource. Access to the
network or a network resource is not performed via a particular Netware 4.x
server (as opposed to Novell Netware 3.x), but via a directory service of the
Novell network (refer to S 2.x5 Design of an NDS concept).
The NDS is the central resource management component of Novell Netware
4.x, and subsequently, high demands are placed on the correct functioning of
this component. The complex possibilities of administration here can result in
the impairment of the availability, confidentiality and integrity of the data, and
give rise to the following threats:
- Access to the network by a user requires authentication to the NDS. This
login takes place on the nearest Netware 4 server that contains the master
partition of the directory tree, or at least a copy of it. If an insufficient
number of copies is present in the network, all users will require
authentication on the same server. Each login places an additional load on
the server and the network. This can result in delayed response times
during login procedures and impair the availability of resources.
If no copies of the master partition have been placed on other Netware 4
servers, the occurrence of an error in the NDS database makes it
impossible to log into the network.
- The higher the number of organisations and sub-organisations within a
directory tree, the greater the administrative effort required. In addition to
that, the localisation of network resources becomes more and more
complicated for the administrators and for the users
- If a location in a WAN does not hold a copy of the related local partition, a
failure of the WAN makes it impossible to log into the network from that
location.
- The higher the number of copies of a partition created in a WAN, the
greater the volume of traffic in the WAN will be, due to the fact that the
login date needs to be changed in all copies of the partition each time a
user logs in.
- The various versions and patch levels of Novell Netware Version 4 can
also hold different versions of the DS.NLM module. However, this
information is used by the Netware 4-servers to filter requests for
modification to the NDS database. This can prevent the Netware 4 servers
from notifying each other of changes to the NDS data, thus resulting in
inconsistencies.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000