PC Direct 1995 May

home *** CD-ROM | disk | FTP | other *** search

/ PC Direct 1995 May / PC Direct CD-ROM (May 1995).ISO / ipe / protec / manual / chap5.txt < prev next >

Wrap

Text File | 1994-08-09 | 21.8 KB | 525 lines

Chapter 5 User Security As stated in the overview, PROTEC NET utilizes Novell NetWare's groups, users and passwords to provide user security. Therefore, all users and groups must be installed using NetWare's Syscon program. If a user forgets his password, you must also use NetWare's Syscon program. This section explains the security parameters that may be defined for a group which include Object Reuse parameters and Group Access Permissions. In addition, this section covers assigning a user a Primary Server and Login Shell. =========================== Group Menu and Object Reuse =========================== Edit Group Configuration allows a supervisors to define how certain workstation objects may be reused by each group. · Group Menu. Group menu allows you to specify which submenu of the Application Manager a user sees after he signs onto the system. The workstation Login Shell must be set to PMENU.EXE to utilize this option. For information on Login Shell, refer to Login Shell. · Clear System Memory. Clear Ssystem Mmemory prevents users from scanning through RAM to find sensitive data used or created by a previous user. Specifically, PROTEC NET overwrites each area of memory allocated for an application before DOS de-allocates its memory. · Wipe Erased Files. Wipe Erased Files prevents users from accessing information within a deleted file. When a user deletes a file, PROTEC NET opens and writes patterns to the file before DOS actually deletes it; making the file useless. · Save Interrupts. This feature prevents users from monitoring information generated by other users. Specifically, it prevents a user from obtaining other users' passwords. Save Interrupts records the interrupt table at login and then restores it when a user logs out of PROTEC NET. It records the following interrupts: · BIOS function 13h: Disk Read · BIOS function 16h: Keyboard · BIOS function 9h: Keyboard · BIOS function 14h: Comm Port · Low-Level Read and Write Protection. These options prohibit users from reading or modifying information on disk using low-level utilities such as Norton Utilities. When activated, Low Level Read allows programs to read data on disk using DOS function 25h or BIOS function 13h. The Low- Level Write option allows programs to manipulate data using DOS function 26h or BIOS function 13h. To stop users from modifying information using low-level utilities, deactivate at least Low-Level Write. To Set Object Reuse Parameters 1 Access the Security program, PSECURE.EXE. Refer to Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit Group Configuration(ALT, U, E). 3 From the scroll box, select the user you wish to edit and press ENTER. 4 Set the proper parameters you wish to configure. 5 Choose the SAVE button. ======================== Group Access Permissions ======================== Workstation resources can be protected by defining Group Access Permissions. Group Access Permissions specify if and how users of a NetWare group can access workstations and their resources: files, directories, drives, workstations, serial and parallel ports, the system clock and submenus. PROTEC NET automatically sets permissions to secure its resources both on the workstation and on the Security Server. From a PROTEC NET workstation, only supervisors may access the PROTEC directory and the PROPUBLIC and PROSYSTEM directories on the Security Server. During signon, users are given limited access to the PROPUBLIC directory so that PROTEC NET can upload local audits to the Security Server and update workstation security properly. Since NetWare is a closed system, an extra level of access rights is set within NetWare to allow users limited access to the PROPUBLIC directory. To do so, PROTEC NET server installation assigns each user to the PROTEC_GROUP which has directory trustee rights [ RWC MF ] for the PROPUBLIC directory. Once a user is verified as a NetWare user and security has been updated, PROTEC NET overrides these NetWare permissions and protects all of its directories. ==================== Permission and Codes ==================== Not all permissions may be assigned to all resources. The following chart lists each permission available to the system, its code, the resources to which each permission can be assigned and the permission description. The resources displayed in this chart are abbreviated and each abbreviation is described below. F for File Di for Directory Ds for Drive. P for Ports C for System Clock S for Submenus Permission Code Resource Description _____________________________________________ ATTRIBUTE A F/Di/Ds Allows users to change DOS file attributes. CREATE C F/Di/Ds Allows users or programs to create or modify files. DELETE D F/Di/Ds Allows users or programs to delete a file. EXECUTE E F/Di/Ds Allows user or programs to execute an application, .EXE or .COM. MKDIR M Di/Ds Allows users or programs to make directories under this directory. OPEN O F/Di/Ds Allows a file to be opened by a program. Automatically activated when read or write permissions are activated. Non Configurable. READ R F/Di/Ds Allows users or programs to read files. RENAME n F/Di/Ds Allows users or programs to rename files. RMDIR d Di/Ds Allows users or programs to remove directories under this directory. SHELL S F/Di/Ds Allows users to run TO DOS COMMAND.COM from an application. VIEW V F/Di/Ds Allows users or P/C/S applications to view. Must set View to access a file. WRITE W F/Di/Ds Allows users or applications to write to a file. Figure 5.2. Permission Chart =============== Directory Trees =============== Permissions are set for files, directories and drives using Directory Trees. Directory Trees display permissions assigned or automatically granted to each resource. The Permission windows display permissions to all workstation resources recorded by PROTEC NET Log program, BLDTREE.EXE. Permissions may be assigned to each resource. When permissions are assigned, the corresponding Permission Codes appear to the left of the resource as shown in the chart above Figure 5.3. If directory and file resources do not appear for each drive excluding floppies then workstation resources have not been recorded. For instructions on how to record resources, refer to Build Directory Trees. =================== Setting Permissions =================== Only permissions that may be assigned to a resource appears in the Permissions box when setting permissions. The VIEW permission must be assigned to a resource in order for the resource to been seen and accessed. If users should not access or view a resource, deactivate all permissions. By default, a user encounters a DOS error if he tries to access an object of which he is denied access. If the system should alert users of these PROTEC violations, set the Display Violations feature to On. For more information, refer to Display Violations. NOTE The directory tree might not be current. Press F9 to rescan the drive. To Assign Permissions 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit Group Access Permissions (ALT, U, D). 3 From the scroll box, select the group you wish to edit and press ENTER. 4 Select File/Dir/Drive (ALT, F). 5 Select the resource to which you wish to assign permissions. Use the SPACEBAR to mark a resource or multiple resources, or F3 to mark all. · Directory: To access directories on a drive, highlight the drive and press TAB to access the directory window. To find a directory, type in the directory name until the directory is highlighted. Press '+' to search for the next occurrence of the directory or '-' to search for the previous occurrence. · Files: To access files within a directory, highlight the directory and press ENTER. To view files with a specific file pattern, press F7. Press F8 to search for a file or file pattern. 6 Press F6 to assign permissions. 7 Choose the SAVE button.. ============================= How Permissions are Evaluated ============================= PROTEC Security System employs a hierarchy of permissions for files, directories and drives, files being most specific and drives being most general. When a user tries to access a resource such as a file, PROTEC NET allows, denies or limits access to it based on its assigned permissions. In this case, it would be the file's permissions. However, if a user belongs to multiple groups, PROTEC NET evaluates permissions so the user may only access the resource if each set of permissions does not deny him access. When working with multiple groups, PROTEC NET uses the `and' operator to decide whether users can access a resource; this differs from NetWare's logic. To clarify how PROTEC grants or denies permission to an object, review the following example. Example Paul belongs to two groups, PRODUCTION and ADMIN. Figure 5.5 displays the PRODUCTION group's relevant permissions while Figure 5.6 shows ADMIN's. Request: Paul is requesting to execute C:\DOS\FORMAT.COM from his C: Drive identified in each Figure as `[ C:] Paul Abate.' The ADMIN group is granted full access but the PRODUCTION group's permission denies access. Result: Since PROTEC NET employs the `and' operator to evaluate permissions, PROTEC NET denies Paul's request. ================================== Printer and Comm Ports Permissions ================================== Users are either granted or denied access by configuring the On/Off settings for the following eight potential ports: Lpt1:, Lpt2:, Lpt3:, Lpt4:, Com1:, Com2:, Com3: and Com4:. If the port is checked users can access the port, otherwise they may not. To ensure only authorized NetWare users may manipulate a workstation remotely, make sure PROTEC's Login screen is the current screen and keyboard lock is activated. To Allow Access to a Port 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit Group Access Permissions (ALT, U, D). 3 From the scroll box, select the group whose port access rights you wish to edit and press ENTER. 4 Select PRN/Comm (ALT, P). 5 Check the port that users may access by using the activation keys, or highlighting the port and pressing the SPACEBAR. ============================ System Clock Access Control ============================ PROTEC Audit tracks user operations by date and time. If you do not want users to change the system's date and time, this option allows you to disable that privilege. To Deny Users to Change the Date and Time 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit Group Access Permissions (ALT, U, D). 3 From the scroll box, select the group you wish to edit and press ENTER. 4 Select Clock (ALT, L). 5 Press ENTER so that the word 'No' appears to the right of Change Date and Time. ====================== Submenu Access Control ====================== If you are using PROTEC's menu program - the Application Manager (PMENU.EXE) -- as the Login Shell for a user or system, you may specify which submenus users may access. If a user is denied access to a submenu, the submenu is hidden from the user when he signs onto the system. To Deny Access to a Submenu 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit Group Access Permissions (ALT, U, D). 3 From the scroll box, select the group you wish to edit and press ENTER. 4 Select Submenu (ALT, S). 5 From the scroll box, select the submenu a group may access and press ENTER so that the word 'No Access' appears to the left of the submenu. 6 Choose the QUIT button to quit and save. ================ User Login Shell ================ Edit User Configuration allows supervisors to assign a user a Login Shell. · Filename. A filename must always be specified. The filename syntax is as follows: drive:\path\filename.ext where .ext must be .COM or .EXE. To run a batch file, specify COMMAND.COM as the default program and specify the batch file on the Command Line, as shown below. · Command Line. The command line is optional and allows you to specify command line parameters required by the default program. It also allows you to run a batch file if COMMAND.COM is appointed as the Login Shell filename. The command line syntax for a batch file is as follows: /c drive:\path\filename.ext where /c must precede the file name and .ext must be .BAT. · Select Button. The Select button allows you to select or search an application from network drives using only directory trees. · Reset Button. The Reset button sets a user's login shell to PROTEC NET's Application Manager. To Specify a Login Shell for a User 1 Access the Security program. Refer to section Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Edit User Configuration (ALT, U, I). 3 Enter the default program and command line parameters if required. 4 Choose the SAVE button. These changes will not take effect until the next user logs onto the system. ==================================== Assigning Each User a Primary Server ==================================== Assigning a user a Primary Server is essential to accessing a PROTEC NET workstation. A Primary Server is the Security Server where a user's access rights reside. Each user should be assigned only one Primary Server in a multi-server environment. A Primary Server can be changed at any time. Once a Primary Server has been changed, Group Access Permissions must be defined on the user's new Primary Server. If more than one Security Server is available and a Primary Server has not been assigned, PROTEC NET denies access to the workstation when a user attempts to signs onto the workstation. To Assign a User a Primary Server 1 From the PROSYSTEM directory on the appropriate Security Server type: primsrvr /a servername/username where servername is the new Primary Server. For information on changing a user's Primary Server or generating a Primary Server report of all available Security Servers, refer to PROTEC NET Programs, PRIMSRVR.EXE. ================ Master Password ================ You can access each workstation with a master password when the server is down. If a change is made to the master login ID and password but has not been downloaded to each workstation, you can access the workstation using a previous password. Therefore, it is wise to keep a record of previous master passwords. The default Master Password's Login ID is 'MASTERID'. The Master Password is `MASTERPASSWORD'. To Assign a Master Password 1 Access the Security Program. Refer to section Accessing the Security Program for step by step instructions. 2 From the User Security menu, select Master Password (ALT, U, M). 3 Enter the login ID and password. 4 Choose the OK button.