Netware Super Library/Netware Super Library.iso/security/jclutils/jclutils.doc

Text File | 1994-02-05 | 8KB | 155 lines

The JCL Utilities for Netware 3.11                                      2/6/94
==============================================================================

The Cast:  MULTCONN   -  Lists all accounts authorized for multiple logins,
                         and shows the number of sessions authorized.
           NOPWORD    -  Lists all accounts that have no password, or do not
                         require a password.  Notes also if such accounts are
                         disabled or station-restricted.
           NWDISABL   -  Lists all disabled accounts.

The JCL Utilities is a growing collection of command-line utilities meant to
give net administrators quick, direct access to important information not
easily available from the tools shipped with Netware.

The author wears several hats as a technologist with a major bank's trading
room, including the role of information risk manager.  In that role I quickly
found a need for these utilities and wrote them myself versus paying for
someone else's work for simple information that Netware should be able to
provide me easily but does not.

These three utilities are geared strictly to risk management.  For example,
ever wish you could get a list of disabled IDs in about 2 seconds?  How about
a list of those authorized for multiple connections?  Got any IDs with no
passwords?  Are they station-restricted?  Answers to these questions is
available with these tools, quickly and accurately.  Believe me, the first
time you run these, you may find some real surprises lurking in your bindery!

These utilities are part of my attempt to monitor our own shop.  The programs
have been in use in production environments anywhere from 7 to 18 months.
They are non-intrusive (do only read-only types of Netware calls), but convey
a wealth of information quickly.  The best news to you is that THEY'RE
FREEWARE, FOLKS!  All I ask is that you distribute this ZIP exactly as you
found it.  In addition, I ask that you pass along any comments or
constructive criticism.

If you're interested in the C++ source code, just ask.  I'd be happy to have
someone improve these or add to the collection.  Serious inquiries from
fellow programmers would be welcome ... see note about other utilities at the
end of this doc.


PROGRAM REQUIREMENTS
--------------------
Each of these three programs has the same run-time requirements:

Requires BTRIEVE.EXE (included) or Brequest.  Program dynamically loads and
unloads Btrieve if it is not already in memory; thus, Btrieve must either be
loaded, in your current directory, or on your path.  Btrieve is used to write
a temporary file, deleted at program termination, to facilitate output of
names in alpha order by login name.  The user running the program must have
console-operator priviledges, and either supervisory or RWCEF rights in
current drive and directory.  Must be run from a network drive, as that's how
the program determines default server on which to report.


MULTCONN.EXE
------------
Lists to standard output a list of all accounts authorized for multiple
connections, including login name and full name.  If a user has unlimited
connections, then the number of connections shown will be the maximum number
of connections permitted under your Netware license.  Output includes server
name and system date.


NOPWORD.EXE
-----------
Lists to standard output a list of accounts that either require no password
or have no current password (there IS a difference!).  Also indicates if each
such account is disabled or is station-restricted.  Output includes server
name and system date.


NWDISABL.EXE
------------
Simply lists to standard output a list of all disabled accounts, both login
name and full name.  Output includes server name and date.


THE AUTHOR ... hopes you enjoy these utilities and put them to good use.
----------     Respect the spirit of Freeware and distribute them to others
               intact, unmodified and with this doc.

John C. Leon                 Residence: 713-359-3641
3807 Wood Gardens Court      Office:    713-216-4007
Kingwood, TX  77339          Fax:       [phone]
                             CIS:       72426,2077
                             Internet:  [e-mail]


INTERESTED IN MORE?
-------------------
While the above utilities use Btrieve, albeit transparently to you, there are
two other utilities in regular use at our shop that are even more valuable
than the above, that rely on the Paradox Engine.  This is so a database file
can be created that can easily be browsed, queried, and is conducive to
creating reports.  These two are LOGLIST and LOGGER.  They are not included
here since, tho in use for many months, they are more complex and not as
bullet-proof as those in this distribution.  If you're willing to help
improve them or willing to use them as is, you can have them and their C++
sources gratis.

LOGLIST
-------
Creates a Paradox 4.0 table and adds one record for every existing login ID.
Runs in seconds.  Fields include server name, login name, full name, password
length, password expiration interval, # connections authorized, last login
date, disk space in use, and whether the ID is disabled or not.  The only
known bug/problem is in the disk space routine.  It currently assumes 4K
disk blocks on the server, and only reports on the SYS volume (that's all
our shop generally has).  Other than that, it's a gem of a command-line
utility.  Typically run weekly, we query the table for IDs not used in the
past 45 days (our criterion for disabling the ID), sort it to find the
biggest disk hogs, etc, etc.  It's also great for documenting your LAN
security review.

LOGGER
------
Not directly related to LAN security or risk management, LOGGER is the most
aggressive program in the bunch.  Intended (and so used in our shop) to be
run at each login for every user, it records in a Paradox 4.0 table a wealth
of user and workstation data.  We typically purge the file every 30
days, retaining the most recent 30 days of data.  Field data includes:

   Network Name, Date, Time, Login Name, Full Name, LAN and Node Addresses,
   DOS Version, BIOS Date, Machine ID, XMS Manager Present, XMS Version,
   XMS Driver Version, Total XMS Memory, whether DOS is loaded high, IPX
   Version, Shell Version, Shell Type (convention, ems, xms), LAN Driver
   Version and Description Strings, Count of Floppies and their types, count
   of hard disks, their total size and current free space, CPU type, video
   type, total conventional, EMS and XMS memory, location of EMS page frame
   if present, mouse type, mouse hardware type, mouse irq, mouse driver
   version, detects presence and version of QEMM, presence of DoubleSpace
   drives and the Microsoft CD Extensions and their version number.

Known problems/bugs/complaints with LOGGER:

1. Though in use daily on four large networks for nearly 18 months with no
   problems, others have found that it occasionally locks up a PC.  Cause
   remains a mystery (no time or resources to debug something that works so
   well in our own workgroup), but the problem seems curable by use of ODI
   drivers versus the old dedicated IPX drivers.

2.  The CPU check is rudimentary.  Only reports 8088, 80286, 80386, 80486.
    Does not bother checking for SX, DX, DX2, etc.

3. No attempt is made to measure CPU clock speed.

4. The video check is rudimentary.  Only reports MDA, Hercules,
   CGA, EGA, VGA.  No tests for particular SVGA, XGA or XGA-2 types/chips.

5. Though not checked in some time, has historically aborted (but cleanly
   and with an error message that I haven't yet checked out) when run under
   OS/2 2.0 or 2.1 DOS sessions.  Perhaps a problem with the older OS/2
   Netware Requesters (?).