IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
they have been deleted. This means that the right Create is only useful at
container level.
For a clearer overview, easier administration and improved auditing
capability, access rights should be assigned primarily to user groups (file and
directory rights) and to container objects. A container represents all objects,
particularly user objects, which are located below the container object in the
NDS. These rights really are assigned to all users, not only those who are
located directly in the container.
For NDS rights to objects and object properties, there is the object
organisational role (OR). The OR can be compared to a group. Groups pass on
any file or directory rights they receive to all their users who are entered as
members. In the case of an organisational role, the rights are passed on to
members of the organisational role. Here, though, the members are referred to
as occupants. This is the term used by Novell. Both for groups and for
organisational roles, the rights are transferred to the members or occupants
with the help of Security Equal To mechanisms. As in practice far fewer NDS
rights are allocated than file rights, the OR is used much less frequently than
for groups.
Rights can also be allocated directly to users and by using Security Equal To.
However, the clear overview can very easily be lost and these mechanisms
should, therefore, seldom be used. To sum it up, the ways in which rights can
be allocated are:
- Groups (File and directory rights)
- Organisational role (NDS object and NDS object property rights)
- Containers
- Users
- Security Equal To
To prevent an inadvertent release of directories by users, the system
administration should not grant "Supervisor" (S) or "Access Control" (A)
rights in the directories and files assigned to the user groups and users.
If certain directories or files are assigned certain attributes - e.g. writeprotection
(Ro) - with the help of Netware attributes, it must be noted that
users who have been granted the "Modify" (M) access right for these
directories or files are able to change their attributes. For this reason, the
number of users in possession of this access right should be restricted to a
minimum.
Inheritance of access rights in the NDS and in the file system
All of the rights dealt with so far are subject to similar mechanisms. This
involves important terms such as inheritance of rights, inheritance filters
(IRF), effective rights (ER) and access control list (ACL), which are explained
in the following.
Inheritance of rights
Rights are usually inherited both in the NDS and in the file system. This
means, for example, that a right which is allocated in the root, either in the
NDS tree or in the file system, is inherited by all objects, directories and files,
which are located below the root. If a right is allocated further down in the tree
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000