Online Praxis 1998 March

home *** CD-ROM | disk | FTP | other *** search

/ Online Praxis 1998 March / Image.iso / CD-ROM / TOOLS / VIREN / SL95ELS.EXE / MANUAL.TXT < prev next >

Wrap

Text File | 1997-10-06 | 27.8 KB | 652 lines

StopLight(R) 95 ELS for Windows 95 and Windows 3.x This product is not freeware or shareware. This product can be used for commercial or private evaluation purposes only. It is identical to the retail version with the following exceptions: 1. The hard drive is not protected from floppy disk boot access. 2. The Master Admin password is displayed on the login screen. To login as Master Admin, use the name SUPERMSF and password AKVPPEOK. To order StopLight 95 ELS, visit our WWW site at http://www.safetynet.com and select the "Order" link. We've implemented SSL security to safely accept credit card orders. A serial number and password will be sent to you via e-mail once your order has been processed, allowing you to unlock this evaluation to turn it into the commercial version. For additional assistance, please contact: Safetynet, Inc. 140 Mountain Ave. Springfield, NJ 07081 USA 1-973-467-0465 - Sales & Technical Support 1-973-467-1611 - Fax 1-973-467-1581 - BBS (28800,N,8,1) +1-908-276-9641 - International www.safetynet.com - WWW (Sales & Technical Support) safety@safetynet.com - Email go cis:safe - Compuserve Safetynet products are available on GSA Schedule. Single unit, volume discount and site license pricing is available. For information on becoming a reseller of our products, please contact our dealer sales department at the address listed above. -------------------------------------------------------------------------- Safetynet, Inc. is a member of the National Computer Security Association (NCSA) and the Information Systems Security Association (ISSA). Copyright Notice This software package and document are copyrighted (c) 1991-1996 by Safetynet, Inc. Portions (c) Eliashim, Inc. All rights are reserved. No part of this publication may be reproduced, transmitted, stored in any retrieval system, or translated into any language by any means without the express written permission of Safetynet, Inc. Disclaimer Safetynet, Inc. makes no warranties as to the contents of this documentation and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Safetynet, Inc. further reserves the right to alter the specifications of the program and/or the contents of the manual without obligation to notify any person or organization of these changes. Trademark Notice StopLight and Drive-In are registered trademarks, and VirusNet, LANSD, LAN Scheduler and Distribution and ProfileNet are trademarks of Safetynet Inc. All other trademark names referenced are for identification purposes only and are proprietary to their respective companies. -------------------------------------------------------------------------- Welcome to StopLight(R) 95 ELS StopLight is a PC security system that combines exceptional power with ease of use. StopLight provides the essential features required for protecting PCs and laptop computers. With its very low memory and disk requirements and simple operation, StopLight can easily integrate with your system. During normal operation, you will not even know that security is there. But if an intruder or hacker attempts to get at your sensitive information, or perform an unwanted action, StopLight will immediately come to the rescue. StopLight provides security by preventing unauthorized users from accessing the computer. Security profiles can be set up quickly for the administrator and 255 users. An almost unlimited number of possibilities can be assigned to each user based on the type of access that is deemed appropriate. And through its log file, user activity and attempted violations can be tracked. StopLight quietly protects your computer and its files from unauthorized activity in the background, providing you with a secure and highly productive environment. SYSTEM REQUIREMENTS Hardware IBM PC, XT, AT, PS/2 or true compatible PC with 500K free space on Hard Drive C. Operating PC-DOS and MS-DOS 3.0 or higher, System Microsoft Windows 95 or Windows 3.x Network (Optional) Netware, NT Advanced Server, Vines and all networks supporting a DOS client Video Display Any Windows-compatible screen display is supported. Memory 384K of free RAM required. StopLight uses 15K of conventional or upper memory for its security kernel. Mouse (Optional) Any Microsoft and MS-Mouse compatible mouse. TECHNICAL SUPPORT We have included many features which make StopLight as user-friendly and helpful as possible. If you run into a problem during its installation or use, please refer to the on-line Windows help. If you have found a problem or situation that is not covered, contact our technical support department as described at the beginning of this guide. When calling for technical support, you should be at the computer in question so that our support personnel can effectively work with you. You may need to be logged in as System Administrator to properly solve the problem. ------------------------------------------------------------------------- 1. Security Features This chapter provides an overview of security concepts and how they are implemented in StopLight. To successfully implement a security strategy, you should become familiar with this chapter. If you are already proficient with security systems, you may only need to skim over this information before moving onto the installation instructions found in the next chapter. PASSWORD MANAGEMENT Use of passwords, variously controlled and managed in the background, is the essence of protection offered by StopLight. The system administrator may establish a flexible security system by defining users and their passwords in different combinations described below. Use of individual passwords for access to the system during login is the first stage of security offered by StopLight. Examples of user name and password combinations offered by StopLight follow: a) Name and Password: This is the default setting and is deemed appropriate for most situations. The user name will be displayed on the screen but the password will remain concealed. b) Password, No Name: It is possible to enter a password without the need to have a user's name. In this case the user will simply enter the password and skip the name entry. c) No Password, No Name: In some cases, for example, in classrooms where users do not require confidentiality from each other, security can be provided without assigning user names and passwords. Initial PC access will be possible by merely pressing <Enter> when prompted at the login screen. Students will then receive the security profile defined by USER1 in the Setup Users section described below. Along with other protection, security can be provided for the AUTOEXEC.BAT and CONFIG.SYS files, virus protection can be activated, and the hard disk can be protected against formatting. d) No Password, Many Names: A fourth possibility is to allow access by entering the user's name only (no need for a password). This option is particularly useful for systems where every user has equal access to the system but the output itself must be separated (for example, an accountant may want to compute the total time spent on one customer for billing purposes). For security reasons, when logging in as SYSADMIN the password will still be required. The system administrator controls the use of passwords by the users in different ways. A minimum valid length for the password may be specified. Thus, even if users are allowed to replace their password, it may not be shorter than the minimum length. The system administrator may also specify the number of times or days that a given password may be used. After the password has expired, access to the system with this password will be denied. The user's name is not normally a password since it is visible to all when entered on the screen. However, the password itself is known only to the individual user. The password is stored in encrypted form to ensure its confidentiality. The system administrator has access to the hard disk with an administrator password. Once logged in, the administrator has access to the complete system including every users' privileges and secure directories. Further, the administrator also has access to the main security menu and to the Global Security Setup and Setup Users. In other words, when logging in as administrator, all security protection (except virus protection) is suspended from the computer. Therefore, it is recommended that great care be taken to keep the administrator password completely confidential. When you login as system administrator, you have all privileges including access to the \SAFER directory. It is advisable that you also define yourself as a USER and login as a user while normally using the system. Login as a system administrator only when making changes to the StopLight security system. This will avoid unnecessary exposure to the security system and to the administrator password. SUPER PASSWORD There may be occasions when the administrator password is not available (resignation, vacation, forgotten password), or the security system needs to be uninstalled after booting from a floppy disk (corrupted hard disk, etc.). Under these circumstances, the StopLight Super Password is required. This password is linked to your unique StopLight serial number and cannot be used to access another StopLight package. The Super Password cannot be changed by the administrator and should only be used for emergency purposes. Since the Super Password can access or unlock the system, it is very important that you keep it safe and secure at all times. You may wish to store the Super Password away from the computer in a locked filing cabinet or safe. To login to the system with the Super Password, follow these steps: Boot the computer from the hard disk. At the login screen, for the User Name, type SUPERMSF (and press <Enter>) At the password prompt, type in your Super Password (and press <Enter>). In the eval version, the Super Password is AKVPPEOK. If your computer does not boot and you must uninstall StopLight, please refer to the Appendix section - Hard Disk Problems. RESTRICTED DIRECTORY SAFER Directory The \SAFER directory (usually on drive C:) contains all the security parameters and configuration as set by the system administrator. It contains the security configuration file, the Log file and all other security files generated by StopLight. Only the system administrator has access to this directory. To define access rights to specific files and directories, please see the Trustee Assignments section of this manual. AUDIT TRAIL LOG The Audit Trail Log records DOS and security-related activity performed at any time by each user from the moment of login. By consulting the contents of the Audit Trail Log, the system administrator can globally supervise the activity in the system, check each user's activity, check any attempts to get access to unauthorized areas of the disk, violations, etc., and even get statistical reports of the activity conducted on the computer. The options for Audit Trail tracking are Off, Full, and Brief. Selecting Off prevents any actions from being tracked. It is used when you do not wish to monitor activity. Full and Brief settings track login and logout times, violation messages and programs that are run. The Full tracking option also records all data file activity including Read, Write, Create and Delete. Since most user activity involves data file access, the Full tracking option generates significantely larger log files than the Brief option. Full tracking should only be used if you will be frequently monitoring the audit log. The log file should be periodically cleared to conserve disk space. A flexible Audit Trail report generator helps the administrator manage audit information. Reports are generated based on date ranges, users and activity. Report information is displayed to the screen or exported to data file for use with other programs. Violations are emphasized on the screen in Red for easy recognition. On monochrome systems, violations will appear in Bold. SCREEN BLANKER / KEYBOARD LOCK When a user leaves the computer unattended for a period of time, StopLight can blank out the screen to prevent monitor burn. The computer system will continue to work, but nothing but a moving box will appear (for text mode applications). In graphics applications other than Microsoft Windows, the screen will not display the moving box. Instead, it will be blanked to blue for the Screen Saver and red for the Keyboard Lock. The result is the same, since information on the screen will not be visible to users and the monitor will be protected from burn in. The Screen Blanker / Keyboard Lock can be activated automatically if the computer keyboard and mouse are not used after a period of time. This period of inactivity is adjustable from 2 minutes to 60 minutes. An adjustable hot-key is also available to activate the Screen Blanker / Keyboard Lock on demand. When the Screen Blanker is activated, the user simply presses <Enter> to restore the screen. All underlying screen information will be properly restored. Normally, only the Screen Blanker will appear when you step away from your computer. However, if you want your keyboard lock to activate along with your Screen Blanker, select the "Keyboard Lock During Screen Saver" option on the Users' Privileges window during set-up. For non-Windows graphics programs, a color other than red or blue may be displayed for the Screen Blanker / Keyboard Lock. MS-WINDOWS SCREEN BLANKER A program (EAGENT.EXE) is provided to blank the screen while using Microsoft Windows. During the StopLight installation process, your system is automatically configured to run this program when Windows is started. To activate the screen blanker, double-click on its icon. 2. Installation This chapter lets you install and get acquainted with StopLight and test it with the default settings. When you are more familiar with the system and determine what your requirements are, StopLight can be configured to meet your security needs. StopLight Security Defaults are as follows: System Administrator Name: SYSADMIN System Administrator Password: PASSWORD Superuser Name: SUPERMSF Superuser Password: AKVPPEOK User 1 Name: USER1 User 1 Password: PASSWORD TRUSTEE ASSIGNMENT RIGHTS Trustee Assignments can be added to drives, directories and files. Rights which can be granted (or denied) include (C)reate, (D)elete, (E)xecute, (R)ead and (W)rite. If a right is not given, it is not allowed. Trustee Assignments that are blank for an object mean that the user will have no access to that object. (C)reate - Allows a user to use the DOS Create function to add a new file to a drive or directory. (D)elete - Allows a user to delete a file from the drive or directory. E(x)ecute - Allows a user to run a program from the drive or directory. This must be accompanied by the (R)ead privilege. (R)ead - Allows a user to have Read file access. (W)rite - Allows a user to have Write file access. It is usually accompanied by the (R)ead privilege. (E)ncrypt - Specifies that the specified directory, directory tree or file(s) will be encrypted in real time. This feature is available only in StopLight 95 Pro. When a drive, directory or file is not listed, either explicitly, or by a pattern, the user has full rights. Only items that are included in the Trustee Assignment window are protected. Examples: C:\WKS\ [RW ] Files in C:\WKS will be Read and Write Only. The trailing "\" after WKS means that files in directories under C:\WKS are not affected by these rights and will remain with full access. C:\WKS [RW ] Files in C:\WKS and directories below it have Read Write privileges. (Notice that no trailing backslash is placed after WKS.) C:\SECURE [ ] The C:\SECURE directory (and directories below it) are not accessible to the user since no rights were granted. C:\123\TS.WKS [RWCD] User has full rights to the TS.WKS file. ------------------------------------------------------------------------- 3. End-User Operation This chapter should be read by all users of StopLight. It covers operation when you are logged in as a User (non-administrator). StopLight is a sophisticated security system that will protect your important information and make your computer time more enjoyable. It gives you the privacy and levels of security that will guarantee that no unauthorized user has access to your private files or programs. * StopLight is user-transparent. In other words, it will not inhibit you in any of your activities, unless you do something that your system administrator has not authorized you to do (for example, trying to have access to another user's files!). The system administrator may have assigned a separate safe directory to you where you can store your files without worrying about other users gaining access to them. * StopLight protects the computer's contents. Based on the settings defined by the administrator, various directories and files may be restricted from being accessed. You are one of the authorized users who has been assigned certain access and user privileges by your administrator. This chapter will help you to understand and use the security features of your system. LOG IN When the PC is first powered on, the StopLight login screen will appear, asking you for your Login Name and Password. Type in the information requested and press <Enter> after each line. Upon supplying the correct information, you will gain access to the computer with a certain security profile assigned by the system administrator. Access to the computer will not be granted until you supply the correct information. PASSWORD Proper use of your login password is very important to the security of your information stored on the PC. The system administrator has assigned each user a unique login password. With your password you can prevent other users from gaining access to your files. If you disclose your password to another user, they will then have access to your files. Along with your Login Name you must use this password to enter the system, or access will be denied. If you forget your password, ask your system administrator. Don't try to randomly guess your password at the login screen. Proper password use is critical to the StopLight system. The following sections provide important information regarding password use. Default password If the administrator gave you a password of PASSWORD, you will be asked to change the password to a new one. Type in a new password and press <Enter>. Then type it in again to verify that it was typed correctly. You will then use this new password to access the system. Invalid password Three consecutive attempts to enter the system with a wrong user name or password will produce the message: "System Halted!". You may unlock the system by pressing the reset button and try to login again with your correct user name and password. Expired password For additional security, your system administrator may decide that your password will be valid for a certain period of time or number of valid logins, and then expire. When your password is due to expire, the following message will be displayed on your screen: "Password usage expires, MUST change password!". If you are authorized to replace your password, do so AT ONCE! If not, please notify your system administrator as soon as possible. After the password expires, you will no longer have access to the system! Changing your password An existing password can be replaced on the login screen by following these instructions. 1. Type in your user name and press <Enter>. 2. Type in your current password and press <Home>. (If you are authorized to change your password, two new fields will appear.) 3. Type in your new password and press <Enter>. 4. Type in your new password again to verify that it was typed in correctly and press <Enter>. Your new password will remain in effect until you change it voluntarily, the system administrator changes it for you, or the system requires you to change it. If the administrator has not allowed you to change your password, pressing <Home> after you type in your user name and password will not work. You must notify the administrator that your password needs to be changed. The system administrator may have specified a minimum password length. If the new password you entered is less than the minimum length, a "Password too short" message will be displayed. Please enter a longer password (maximum eight characters). SCREEN BLANKER / KEYBOARD LOCK When the computer is left unattended for a period of time, it is possible to implement a Screen Blanker or Keyboard Lock. Each one blanks out the screen to protect sensitive information and prevent monitor burn. While the screen is blanked, any programs which were running will continue to run. The screen will be replaced by a moving message display. The Screen Blanker is cleared by pressing <Enter>, and the Keyboard Lock is cleared by pressing <Enter>, typing in your login password and pressing <Enter> again. The system will be unlocked and its screen information will be restored. The Microsoft Windows keyboard lock clears the screen and displays a moving message window. DOS-based programs will also be replaced by a moving display. In graphics applications other than Microsoft Windows, the Screen Blanker and Keyboard Lock will blank the screen with a solid color. For most programs, the Screen Blanker will display a blue screen, and the Keyboard Lock will display a red screen. Some programs may change the video display and alter these colors. To regain access to the system, press <Enter> to clear the keyboard buffer. If the screen is not restored, the Keyboard Lock is active. Type in your login password and press <Enter> to restore the screen. Normally, only the Screen Blanker will appear when you step away from your computer. However, to activate the keyboard lock instead of your Screen Blanker, ask the administrator to select the "Keyboard Lock during Screen Saver" choice in the Security Setup program. WHAT A USER CANNOT DO By being granted User access to the computer, you inherit certain restrictions which will keep your computer operating correctly. * A user cannot access the \SAFER Directory. This is the directory where the security parameters are defined by the system administrator. * A user cannot alter or write to the Boot sectors. * A user cannot use the CHKDSK program since no access is granted to the \SAFER directory and other private user directories. If you must use CHKDSK, please contact your system administrator. SECURITY VIOLATIONS If an action results in the breach of any security rules, a warning message is displayed and the action is denied. Typical actions which may breach security include unauthorized access to the CONFIG.SYS and AUTOEXEC.BAT files, and attempting to change to a secure directory. A complete list of messages can be found in the Appendix. LOGGING OFF When you are done working with the PC, you must exit the system in one of the following manners: a) By pressing <Ctrl><Alt><Del>; or, b) By running LOGON when you wish to return to the initial login screen without rebooting the computer. As in the example above, this command may be located in the C:\PUBLIC directory. Your logoff time will be recorded in the Audit Log file when you exit the system in one of the above ways. If you exit the system by turning the computer off, the system will not be able to record the logoff time. Instead, the security system will record this as an "INVALID LOGOFF" and include it as a violation in a report to the system administrator. ------------------------------------------------------------------------- 4. Special Programs Several programs are included with StopLight to enhance its overall performance and flexibility. Some programs are especially useful when placed in batch files. Each of these programs can be used at the DOS prompt or incorporated in a menu system. EX Fixes access denied errors in some programs that try to access secure directories. When these programs encounter a directory that is restricted, they either stop and issue an error message, or rescan the drive in an infinite loop. The EX program will allow these programs to skip secure directories and continue to read the drive properly. Syntax: EX ProgramName KEYBFIX Keyboard fix is for international language KEYBxx support when certain hot- keys are used. This program must be executed in the AUTOEXEC.BAT immediately after KEYBxx is loaded. LOGON Utility to login as another user without rebooting the computer. This utility is essential for accessing a secured system remotely. LOGON is located in the C:\PUBLIC directory and is also accessed from the StopLight Message Agent icon from Windows. WHOAMI Displays the current user name, system date and time. ------------------------------------------------------------------------- Appendix This chapter starts with solutions to common problems that can occur with security software. Then, a list of error messages that the system generates is presented. The final section of the chapter briefly describes other Safetynet products which can complement StopLight. SOLUTIONS TO COMMON PROBLEMS The following section represents situations and suggestions that have been compiled from our customers. Issue Netware does not allow a user to login to the network. A Date/Time Change warning is given. Solution Upon login to Netware networks, the network may try to synchronize your PC's date and time. If you Disable DATE/TIME Change, the network may not let you login. Do not select Disable DATE/TIME Change if you are experiencing this problem. Issue After logging into the network, DOS Shell Access is no longer disabled. Solution Some network drivers (e.g. NETx.COM) do not allow Prevent DOS Shell Access to work properly. To restore this feature, make a batch file that runs these drivers and then runs the StopLight NETFIX.COM utility. Issue Programs that scan the hard disk stop when they encounter a secure directory. Solution Run the program by using the EX.EXE utility to prevent warning messages while scanning the disk. NEW SOLUTIONS If you have implemented StopLight to solve a difficult problem, please let us know. We would like to pass the knowledge on to others. Also, if you have any programs that need special handling when working in a security environment, we would like to hear from you. Please contact our Technical Support department and share your experiences with them. ### End of Manual ###