IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Hidden (H): The file will be labelled as hidden; it will not show up in a
contents list under DOS, neither can it be copied or deleted. I
System (S): This file (e.g. bindery Files -NET$OBJ.SYS, NET$PROP.SYS,
NET$VAL.SYS) is used by the network operating system; it will not show
up in a contents list under DOS, it can neither be copied nor deleted.
Backup of important system files
The server start files AUTOEXEC.NCF and STARTUP.NCF should be saved
by the system administrator in their respective present versions on secured and
stored in a safe place secured against unauthorised access. It is wise to
supplement these files with comments so that the respective set parameters
can be understood when problems arise.
Furthermore, the bindery (NET$OBJ.SYS, NET$PROP.SYS, NET$VAL.SYS) of
a Novell Netware server should be regularly backed up with the help of the
SYS:SYSTEM\BINDFIX.EXE program. The backed up bindery
(SYS:SYSTEM\*.OLD) should then be saved on a data medium and stored in a
safe place secured against unauthorised access.
In any case, after executing SYS:SYSTEM\BINDFIX.EXE the integrity of the
new bindery should be tested. If in doubt, the old bindery can be restored with
the help of SYS:SYSTEM\BINDREST.EXE.
User access to the present bindery is withdrawn during execution of
SYS:SYSTEM\BINDFIX.EXE. For reasons of operational security, no user,
apart from a supervisor or an equivalent-to-a-supervisor user, should be
logged on to the Novell Netware server when backing up the server bindery.
Restricted use of a supervisor or an-equivalent-to-a-supervisor account
The supervisor account should not be used for daily administrative tasks.
Rather, it should only be used in case of emergency. Nonetheless, to ensure
system administration, an equivalent-to-a -supervisor account should be set
up for every user with the "supervisor" network security level, with which the
system administration is normally be carried out. If administrative tasks are
not performed on a full-time basis, additional accounts need to be created
specifically for each non-administrative activity.
Furthermore, a supervisor or an equivalent-to-a-supervisor account should
only be used on the workstations defined for that purpose, since under some
circumstances the integrity of other workstations can be manipulated by users.
Delegation of system administration
In larger networks (many Novell Netware servers or various locations) or with
a large number of users, delegation of certain system administration tasks is
recommended. For this purpose Novell Netware 3.x offers the possibility of
assigning users with user-account-manager or workgroup-manager accounts.
User-account-managers can administrate users and groups which have been
allocated to them by the system administrator. Thus, besides being able to
alter user-data (password, operating time, etc.) they can pass on all the
privileges which they themselves possess. Furthermore, user-account
managers may allocate individual users to a group. In this case, the groups as
well as the users must be administrated by the respective user-account-
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000