IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.151 Design of an NDS concept
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
One of the most important new features in Novell Netware 4.x are the Novell
Directory Services (NDS). NDS are used to manage the logical structure of a
network and all the resources contained therein, such as users, groups, printers
and Netware servers.
NDS technology replaces the bindery which was used in Netware 2.x and
Netware 3.x. The bindery contains a one-dimensional list of all users, groups
etc. However, if several Netware 3.x servers are in use, the administrator faces
the "problem" of having to manually perform every modification (for
example, the addition of a user) on every Netware 3.x server, that is to say on
all servers for which a user is to be granted access rights.
In contrast, the Novell directory services are independent of any particular
server and based exclusively on the underlying network. This means that
administrative activities, such as configuration of a user account, are
performed by the Novell directory services on all affected servers, without the
need for manual intervention by the administrator.
The resources are managed in a database using a tree structure; this structure
is thus also termed NDS tree. In this tree, all users, groups, printers, Netware
servers etc. are managed as objects of an NDS directory database. A
distinction is made between two types of objects here: container objects and
leaf objects. Whereas a leaf object is located at the end of a branch and does
not contain any further objects, a container object can contain additional
containers or leaf objects.
The following container objects exist, among others:
- Root
This is the root of the NDS directory tree. Every NDS directory tree has
exactly one such object which is created during installation, after which it
can neither be renamed nor deleted. Each NDS directory tree can only
contain one such object.
- Country
The country object allows a geographical partitioning of the entire structure
of the NDS directory tree, i.e. a division of the network by country.
However, this object is optional and therefore not specified as default
during the installation of the NDS.
- Organisation
The organisation object is intended for a hierarchical arrangement of other
objects in the NDS directory tree. No fixed rules apply here, as a result of
which, for example, an enterprise can designate the organisation with its
own name or those of its various offices. Every NDS directory tree must
contain at least one organisation.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000