IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
manager. The user-account manager cannot set up new users or groups. He
may, however, delete users or groups which have been allocated to him.
A workgroup-manager has all the privileges of a user-account-manager.
Moreover, he can set up new users and groups. An additional task of the
workgroup manager is the setting-up of printing queues.
Use of the NCP-Packet-Signature
Communication between Novell Netware clients and a Novell Netware-server
is controlled by the Netware Core Protocol (NCP). Client and Server exchange
individual packets which contain data. A potential attacker can monitor these
packets by using special programs (see T 5.58 "Hacking Novell Netware") and
can manipulate packets belonging to highly privileged users.
The Packet-Signature has been developed to counteract this threat. When a
user logs on to the server, a secret key will be established. If a workstation
then sends an inquiry to the server via NCP, it will be provided with a
signature formed from the secret key and the signature of the previous packet.
This signature will be attached to the relevant packet and sent to the server.
The server will verify the packet signature before dealing with the actual
inquiry.
With the option Set NCP Packet Signature -value-, the packet signature can be
activated on the server.
The possible levels of NCP-Packet signature are as follows:
Value "0": There are no NCP-Packet-signatures.
Value "1": The Novell Netware Server is using NCP-Packet-signatures at the
request of the client.
Value "2": The Novell Netware server requires an NCP-Packet-signature
from the client. If the client cannot supply one, communication
between client and server will nonetheless be granted.
Value "3": The NCP-Packet-signature is mandatory.
To ensure IT-security, the value "3" should be selected for NCP-Packetsignature.
Since installation of the NCP-Packet-signature increases network
demands by 30%, it should be clarified beforehand whether the performance
will be unreasonably reduced.
Restriction of available hard disk memory
With the help of the program SYS:PUBLIC\DSPACE.EXE the available hard
disk memory of a volume or directory should be limited, as experience shows
that use of available hard disk memory increases with the capacity of the hard
disk memory.
Alternatively, once set up, the capacity of each user's personal directory can be
restricted if single directories have been set up for work data.
Blocking programs that are not required
Most of the Novell Netware programs available under SYS:PUBLIC will
generally not be required by Netware users, since many of the functions
(printer configuration, password change, allocation of disks) can be carried out
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000