IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
be assigned an account with the same rights as the supervisor object (explicit
trustee assignment, see also Protection against a loss of administrative
capability) which should usually be used to perform system administration. If
administrative tasks are not performed on a full-time basis, additional
accounts need to be created specifically for each non-administrative activity.
The account of the administrator or that of the administrator's representative
should continue to be used only in workstations defined for this purpose, as
the integrity of other workstations could be manipulated.
The account "Admin", which has the sole administrative rights by default,
should have its rights removed because it is a target for attack. The necessary
supervisor rights should be transferred to another, less conspicuous user
account. However, it is possible to simply rename the Admin account,
choosing a name that complies with the general regulations for assigning
names within the NDS, as laid down in the planning of the NDS for the
company.
Protection against a loss of administrative capability
A new function as of Netware Version 4.x allows a decentral administration of
Novell Netware networks. This can be achieved by means of certain
administrative facilities such as the definition of a separate administrator for
each container object. If only one user account has been configured for this
purpose and this account is deleted inadvertently, the related container can no
longer be managed (refer to T 3.25 Negligent deletion of objects).
To achieve the desired effect, an additional measure is thus required in the
form of an explicit trustee assignment for at least one of the user objects of
the user administrator. Therefore, the administrator right should not result
from the mechanism Security Equal To. This prevents a loss of administrative
capability for the container in case the organisational function object is
deleted. This applies in particular to the allocation of rights to the central
administrators of a Netware 4.x network.
Information on Novell Netware patches
During the development of the Novell Netware network operating system,
weak points and shortcomings were discovered, most of which the
manufacturer subsequently remedied with the help of patches or service packs
for versions 3.x and 4.x. These patches can also be obtained from the
manufacturer via the Internet (http://support.novell.com and
http://support.novell.de). Shortcomings identified during operation of the
network can thus be fixed by obtaining information on the network's
functionality and, if necessary, loading the patches which have been made
available. In particular, additionally installed software products, e.g. for the
purpose of performing data backups, often require a certain patch level of the
network operating system. Here though, it must be noted that the offered
patches should by no means be loaded "blindly", but only after a thorough
research if a concrete requirement for them has arisen ("never change a
running system"). As not all patches are error-free, they should first be
checked in a test configuration.
Apart from the international discussion forums in the Internet (Usenet)
regarding Novell Netware (at present, comp.os.netware.announce,
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000