22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

434 Lotus Security Handbook<br />

If a user attempts to switch to full access administrator mode, but is not listed as<br />

one in the Server document, the user is denied full access and a message<br />

appears in the status bar and on the server console. The client will be in full<br />

access mode, but that user will not have full administrator access to that<br />

particular server. If the user attempts to switch servers, that person's access is<br />

checked against the server document of the new server.<br />

Disable the Full Access Administrators field by setting<br />

SECURE_DISABLE_FULLADMIN = 1 in the NOTES.INI file. This setting<br />

disables full access administrator privilege and overrides any names listed in that<br />

field in the Server document. This NOTES.INI parameter can only be set by a<br />

user with physical access to the server who can edit the NOTES.INI file for the<br />

server. This parameter cannot be set using the server console, the remote<br />

console, or in the Server document.<br />

Managing the full access administrator feature<br />

There are several ways to grant full access administrator access:<br />

► Create a special Full Admin ID file – for example, “Full Admin/Sales/Acme” –<br />

and only put that name in the Full Admin field. You must then either log in with<br />

or switch to this user ID in order to gain this level of access. Optionally, you<br />

could set up this ID file to require multiple passwords.<br />

► Create an OU-level certifier for granting full administrator access, and issue<br />

additional IDs to trusted administrators – for example, Jane Admin/Full<br />

Admin/Acme.<br />

► Leave the Full Access Administrator field empty. Add the name of a trusted<br />

individual for emergency situations, and remove it when the situation has<br />

been resolved.<br />

► Populate the Full Access Administrator field with a limited set of trusted<br />

administrators.<br />

You can also track how this feature is used:<br />

► Configure the Event Handler to send notification through EVENTS4.NSF<br />

when full access administration privileges are invoked.<br />

► Any database activity done using full access administrator access is recorded<br />

in the database activity log, under Database Properties.<br />

Use of the feature is also logged by the server.<br />

Important: Administrators who are listed in the Full Access Administrators,<br />

Administrators, and Database Administrators fields on the Security tab of a<br />

Server document are allowed to delete any database on that server, even if<br />

they are not listed as managers in the database ACL.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!