IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.147 Secure migration of Novell Netware 3.x
servers to Novell Netware 4.x networks
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Under Novell Netware 3.x, every server manages information on its users in a
"bindery". One disadvantage of this approach is that in a network consisting of
several Netware 3.x servers, an account for a user must be created on each of
the servers separately. For administrators, this creation of multiple accounts
entails a tremendous effort which can basically not be avoided. In addition,
users need to log into each server separately.
In a network consisting of several Novell Netware 4.x servers integrated in a
NDS tree however, users only log into the network once, after which they can
immediately make use of all the resources which have been released for them
(refer to S 2.151 Design of a NDS concept).
A complete integration of Netware 3.x servers in a Netware 4.x network is not
possible, as these servers continue to operate as independent systems. Users
who need to access Netware 4.x as well as Netware 3.x still require multiple
accounts in this environment.
A feasible alternative to this is the migration of a Netware 3.x server to a NDS
tree. The NETSYNC.NLM product accompanying the Novell Netware 4.x
packages can be used for this purpose. Operation of a Netware 3.x server in a
Netware 4.x network is advantageous in that the user accounts can be
managed centrally on a Netware 4.x server, and no longer need to be
maintained individually on each Netware 3.x server.
This requires the availability of a Netware 4.x server which can manage up to
12 Netware 3.x servers. This server is designated as the host and is needed for
further management of the user accounts, as it transfers NDS modifications to
the bindery of the Netware 3.x server. During migration, a large proportion of
the NLMs of the Netware 3.x servers is replaced, and the servers are then
linked with a host. A restoration of an independent Netware 3.x server would
thus entail a great effort.
The following points must be observed to ensure secure migration:
- The bindery context needs to be set for the container in which the Netware
3.x server is to be created.
- The bindery emulation needs to be specified and activated with the
instruction SET BINDERY CONTEXT = ... in the AUTOEXEC.NCF file on
the Netware 4.x host.
- After migration, changes must no longer be performed with the utility
SYS:PUBLIC\SYSCON.EXE. Other utilities such as
SYS:PUBLIC\FILER.EXE and SYS:PUBLIC\PCONSOLE.EXE are
replaced by NETSYNC.NLM during migration. However, it is advisable to
make exclusive use of the SYS:PUBLIC\NWADMIN.EXE program for
administrative tasks. The SYS:PUBLIC\SYSCON.EXE utility should thus
be removed.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000