IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
rights to an NDS object, they automatically have supervisor rights to the NDS
object properties as well. This phenomenon does not occur the other way
round. Supervisor rights for NDS object properties are not equivalent to
Supervisor rights for the NDS object itself. In must be borne in mind in this
context, however, that the object property Object Trustees (ACL) is a property
of each and every NDS object. If users receive supervisor rights for the
properties of an NDS object or simply the right WRITE for the property Object
Trustees (ACL), they are able to grant themselves or other NDS objects any
rights they choose. An important exception is the NDS object Server. If, as in
the above example, the user Rzenk receives the right WRITE for the object
property Object Trustees (ACL) of the server, this is the same as receiving
supervisor rights for the entire file system that is assigned to this server. The
property Object Trustees (ACL) of the server is therefore the interface between
the NDS and the file system.
Menu diagram: Netware Administrator Server NW4_GT "Trustee of this
Object..."
In order to prevent supervisor rights in the file system being obtained through
improper allocation of NDS rights, Inherited Rights Filters (IRF) can be
activated for every server. This allows the object rights to be separated from
the directory rights. The supervisor right must be filtered for NDS objects and
NDS object properties and the right WRITE for the property Object Trustees
(ACL) must also be filtered. It is of course preferable to be aware of the details
of how particular rights take effect.
Restricted usage of accounts with supervisor rights on the file level
The account "Admin" should only be used in an emergency, and not as part of
regular administrative activities. Nevertheless, to ensure proper system
administration, every user on the Netware security level "Supervisor" should
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000