PC Direct 1995 May

home *** CD-ROM | disk | FTP | other *** search

/ PC Direct 1995 May / PC Direct CD-ROM (May 1995).ISO / ipe / protec / manual / pronet41.txt < prev next >

Wrap

Text File | 1994-11-21 | 30.9 KB | 1,099 lines

Addendum The PROTEC NET Addendum covers important information regarding changes made to the PROTEC NET system that are not included within the PROTEC NET Administration Manual. The Table of Contents only lists sections of the Administration Manual that have changed or provide corrections. The heading `What is New?' provides information on new PROTEC NET features or functionality. ADDENDUM 1 WHAT IS NEW? 3 Update PROTEC NET: Security Server and its Workstations 3 Write Protecting Your Hard Disk during Boot-up 6 Activating Automatic Encryption per Workstation 7 PROTEC NET Programs 8 CHAPTER 1 PROTEC NET OVERVIEW 10 Security Servers and Password Management 10 How Security Works 10 Workstation Security Flow Chart 11 CHAPTER 2 NETWORK INSTALLATION 12 Server Installation 12 Accessing the Security 17 Workstation System Changes 17 Maintaining a Secure System 18 CHAPTER 3 WORKSTATION SECURITY 19 Accessing Workstation Security Features 19 Install, Update or Remove PROTEC 20 Install or Remove Boot Protection 21 Keyboard Lock 23 System Verification 24 When Server is Down or Laptops 24 CHAPTER 4 AUDITS 25 Audit Database Structure 26 CHAPTER 5 USER SECURITY 27 Master Password 27 CHAPTER 6 ENCRYPTION 28 CHAPTER 7 LOGIN SCRIPTS 30 Password Management 30 Login Script Commands 30 CHAPTER 8 PROTEC NET PROGRAMS 33 What is New? Update PROTEC NET: Security Server and its Workstations PROTEC NET provides a simple method of updating the security system both on a Security Server and its associated workstations. To Update Your Server The update program, UPSRVR.EXE updates the specified server without changing any security set-up configurations. This process performs the following tasks: Copies its LOGIN.EXE, LOGOUT.EXE and MAP.EXE programs to the \LOGIN directory on the Security Server if it PROTEC NET Login programs already exists in that directory. Copies its security setup programs to the PROSYSTEM directory. It also copies its NET Script and workstation programs to the PROPUBLIC directory. Files that are copied to the PROPUBLIC and PROSYSTEM directories may be viewed within the PSETUP.INF file located in the PROPUBLIC directory and on the PROTEC NET diskette 1. All files copied to the server are preceded by the label `[files]'. Files copied to the PROSYSTEM directory are followed by `prosystem' whilst files copied to the PROPUBLIC directory are followed by `propublic'. Updates the data files to the current file format including the AUDIT.DBF found in the PROPUBLIC directory. Updates the current workstation if the following environment variables are set within the environment: PROPUBLIC and PROTEC. Refer to the To Update PROTEC NET Workstations for more details. To Update a Security Server 1 Sign onto the appropriate Security Server as a supervisor. 2 Run UPSRVR.EXE from PROTEC NET diskette 1 by using the following syntax: upsrvr servername [source path] servername is the name of the server where you wish to update PROTEC NET. The source path is the path where the update files reside. You do not have to specify a source path if the update files reside at the same location as UPSRVR.EXE. To Update PROTEC NET Workstations Before you can update your workstations that are presently secured by PROTEC NET, you must update PROTEC NET on the server. To do so, refer to the previous section To Update Your Server. PROTEC NET updates workstation security when a user signs onto the system. Specifically, the NET Script program UPP.EXE checks to see if a workstation has been scheduled to be updated. If so, it only updates PROTEC NET if the version on the workstation is older than the current version on the associated Security Server. Supervisors are responsible for setting the AutoUpdate option within the Security program to inform UPP.EXE to do so. PROTEC NET performs the following tasks when it updates its workstations: Copies the appropriate security files to the workstation. Files that are copied to the workstation may be viewed within the PSETUP.INF file located on the PROTEC NET diskette 1. All files copied to the workstation are preceded by the label `[workstation files]'. Copies new Boot Protection driver, PROTEC3.SYS, to the \DRIVERS directory on the workstation. This driver is aware of the methodology used in any previously released versions of PROTEC NET. Copies the new security kernel, LOADER.COM, to the root directory on the workstation's C: Drive. Updates data files located in the PROTEC directory. These may include PSYS.DAT, AUDIT.DBF and USERSRVR.DBF. Sets the system so that a new local copy of PROTEC is copied down to the workstation when the next user signs onto the workstation. Refer to Update Your Server for specific information on changes made to the workstation. To Update a PROTEC NET workstation 1 Go to the PROSYSTEM directory (SYS:SYSTEM\PROTEC). 2 Type netsec. 3 From the Workstation menu, select Install/Update/Remove PROTEC. 4 Select the workstations you wish to update. 5 Select the AutoUpdate option. 6 Choose the SAVE button. The workstation is updated the next time UPP.EXE runs from the workstation. Refer to Login Scripts, System Login Script and Server Installation for information on NET Script programs. NOTE UPP.EXE functionality has changed from previous versions of PROTEC NET. Write Protecting Your Hard Disk during Boot-up Boot Protection provides two new features that provide back-up access protection during normal boot-up. Disable writes to hard disk during boot-up. This feature stops users from writing to the hard drive until they sign onto the PROTEC NET workstation. Boot-up Timeout. If the Security Kernel LOADER.COM does not load within the specified number of seconds, the system comes to a halt. The user must cold boot the computer before he can access the system. Activating Automatic Encryption per Workstation In order for a user to access files automatically that are encrypted by PROTEC NET, the Automatic Encryption feature must be activated for the appropriate PROTEC NET workstations. To Activate Automatic Encrytpion 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the Workstation menu, select Automatic Encryption (Alt W, T). 3 Select the workstation you wish to activate automatic encryption and press ENTER. PROTEC NET Programs PCONFIG.EXE and UPSRVR.EXE are new PROTEC NET programs. PCONFIG.EXE Location: W PROTEC directory Type: Security Syntax PCONFIG [/mono] Description PCONFIG updates information stored on the local workstation such as master and local passwords and local copies of PROTEC. This program also ensures the proper audit records are copied up to the user's Primary Server when the user signs onto the system. This utility is used internally by PROTEC NET. Refer to Audits for more information on storing and updating audit records. UPSRVR.EXE Location: SS PROSYSTEM Directory Type: Security Setup Syntax UPSRVR servername [source path] Description UPSRVR allows a supervisor to update a Security Server to the new version of PROTEC NET. Parameters Parameters Value Description servername name of a valid A previous version of PROTEC NetWare file server. NET must already be installed onto the server. source path any valid DOS The location where the new directory. PROTEC NET files reside, most likely A:. Chapter 1 PROTEC NET Overview Security Servers and Password Management Page 1-3, PROTEC NET Script Program chart. UPP.EXE should read as follows: UPP.EXE is in charge of updating security on a PROTEC NET workstation to the current version of PROTEC NET found on the associated Security Server. How Security Works Additional Information. Before permissions are loaded, PROTEC NET makes sure local information is current. This includes the PROTEC NET's master password and the local copy of PROTEC or local passwords. Further, local audit records are copied to its master AUDIT.DBF on the Security Server. For more information, refer to PROTEC NET programs, PCONFIG.EXE within the this document.. Workstation Security Flow Chart Page1-5, Workstation Security Flow Chart. The following chart replaces the chart found in the Administration Manual. Chapter 2 Network Installation Server Installation NetWare Bindery Changes Paragraph 4, Line 2. The statement "A property may not be added to a user's record if the installer verifies the user is already assigned a Primary Server" should be replaced by the following statements "A property is always added to a user's record indicating the server is the user's Primary Server. If a user has the same user name for multiple servers, you must run PRIMSRVR.EXE to ensure a user has only one Primary Server." Server Installation - First Time Page 2-3, Figure 2.1. Default Installation Configurations screen has changed to the following screen: Page 2-3, To Install the PROTEC NET System onto the Network Server. Changes for the step by step instructions are specified below: To Install the PROTEC NET System onto the Network Server 1 Log onto the destination server as either the Supervisor or a user with supervisor security equivalence. 2 Run NETINST.EXE from PROTEC NET Diskette 1. The following step "Step 3" has been added to this list of instructions on how to install the PROTEC NET System onto the Network Server. 3 Destination Server. Select the Destination Server. Note that the servers that are listed in the combo box are the servers to which you are attached. If the server onto which you wish to install PROTEC NET, exit the program by pressing the CANCEL button and attach to the appropriate server. The following step "Step 4" used to be "Step 4". All steps that follow are incremented by 1. This means "Step 4" is changed to "Step 5" and so on. 4 Scripts. Page 2-4, Figure 2.2 has been modified as follows: SET PROPUBLIC="servername/SYS:PUBLIC\\PROTEC\\" #servername/SYS:PUBLIC\PROTEC\NAMER.EXE #servername/SYS:PUBLIC\PROTEC\BLDTREE.EXE #servername/SYS:PUBLIC\PROTEC\AUTONVLL.EXE #servername/SYS:PUBLIC\PROTEC\RBP.EXE #servername/SYS:PUBLIC\PROTEC\UPP.EXE. The PROTEC NET Script programs are always located on the SYS: volume. Page 2-5. The sentence "Each PROTEC NET Script program is listed in the chart below with a brief description of its responsibilities." should read as follows "Each PROTEC NET Script program is listed in Figure 2.3 with a brief description of its responsibilities." Figure 2.3. UPP.EXE description has changed and is listed below: NET Script Program Description UPP.EXE Updates workstation security to the current system found on the corresponding Security Server. The Workstation ID must be recorded before updating the workstation. UPP.EXE only updates security if scheduled through PSECURE.EXE and PROTEC is installed. 5 Backup Script File. Additional Information. The following information provides information on naming conventions used to backup System or user login scripts. "The System Login Script found in the \PUBLIC directory on the SYS: volume is copied to the PROPUBLIC directory and renamed BACKUP.DAT. User scripts are copied from their \MAIL directories and renamed using the following syntax: userIDnumber.LOG where userID number is the number that is assigned to a NetWare user name when the user is created under NetWare. 6 Insert MAP S16:=SYSTEM\PROTEC into Supervisor's login script. Additional Information. The following note provides the supervisor with helpful hints for setting up search paths within user login scripts. NOTE It is helpful to add a search path to the PROPUBLIC directory as well as the PROSYSTEM directory as shown above. Add these search paths to other users' scripts who have supervisory equivalence and maintain workstation security. 7 Use PROTEC Login Programs. Page 2-6. The sentence "PROTEC NET copies these programs to the server's \LOGIN directory and stores backup copies of the original programs to the PROSYSTEM directory." should read as follows "PROTEC NET copies these programs to the server's \LOGIN directory and stores backup copies of the original programs to the \LOGIN\OLD directory." 8 Copy PROTEC programs to the server. Page 2-6. The statement "Files are copied to each directory and are listed within the PSETUP.INF file located on PROTEC NET disk 1. Files copied to the PROSYSTEM directory are preceded by the label '[system files]' whilst files copied to the PROPUBLIC directory are preceded by the label '[public files].' should read as follows "Files that are copied to the PROPUBLIC and PROSYSTEM directories may be viewed within the PSETUP.INF file located in the PROPUBLIC directory and on the PROTEC NET diskette 1. All files copied to the server are preceded by the label `[files]'. Files copied to the PROSYSTEM directory are followed by `prosystem' whilst files copied to the PROPUBLIC directory are followed by `propublic'. The remaining steps for this installation found in the Administration manual are accurate. Accessing the Security Additional Information. The Security program, PSECURE.EXE, is a front end to two executables: NETSEC.EXE and PERM.EXE. PERM.EXE can be used to set Group Access Permissions whilst NETSEC.EXE sets workstation security, user settings and object reuse parameters. Workstation System Changes Additional Information. WIN.INI If PROTEC NET Windows Keyboard Lock is activated, PROTEC NET automatically inserts a command to load its timer module within windows by modifying the WIN.INI file as follows: LOAD=C:\WINDOWS\KEYTIME.EXE Maintaining a Secure System Page 2-18, First Point. The sentence "The PROPUBLIC directory must be accessible by all NET users." should read "The PROPUBLIC directory must be accessible by all NetWare users." Chapter 3 Workstation Security Accessing Workstation Security Features Page 3-2, Figure 3.1. The cell which reads "Keyboard Lockout, the PROTEC_GROUP and the PROTEC_USER" should read "Keyboard Lockout" Install, Update or Remove PROTEC Page 3-5. This feature "Install/Remove PROTEC" now appears as "Install/Update/Remove PROTEC" within the Security program. Additional Information. The Update feature referred to as AutoUpdate allows supervisors to centrally distribute updated PROTEC NET software to a PROTEC NET workstation. If activated, it specifically updates each workstation to the current version of PROTEC NET found on the associated Security Server. This feature only updates if PROTEC is loaded in memory and the version of PROTEC NET on the workstation is older than PROTEC NET found on the Security Server (which is the user's Primary Server). Page 3-5, Figure 3.4. The following screen replaces Figure 3.4 found in the Administration Manual. Figure 3.4. AutoUpdate a PROTEC NET Workstation. Install or Remove Boot Protection Page 3-7, Figure 3.5. The following figure replaces the Figure 3.5 found in the Administration Manual. Figure 3.5. Boot Protection Configuration Two new features have been added to Boot Protection as shown in Figure 3.5. Disable writes to hard disk during boot-up. This feature stops users from writing to the hard drive until they sign onto the PROTEC NET workstation. Boot-up Timeout. If the Security Kernel LOADER.COM does not load within the specified number of seconds, the system comes to a halt. The user must cold boot the computer before he can access the system. Emergency Removal Page 3-9, To Retrieve the Workstation's Keydisk procedures. The following procedures replace the associated features found in the Administration Manual. To Retrieve the Workstation's Keydisk 1 From the appropriate Security Server, change to the PROSYSTEM directory. 2 Run copykey. 3 Select the Source Path. Keydisks are originally created in the PROPUBLIC directory. 4 Select the corresponding workstation's keydisk. All keydisks are created during Boot Protection installation. 5 Specify the destination path as A: or B:. The keydisk is created on the destination drive along with RBPKEY.EXE. RBPKEY.EXE removes Boot Protection from a workstation using its keydisk. 6 Enter keydisk password. Keydisk passwords are not case sensitive. Password lengths must be between 1 and 20 characters. 7 Write down the keydisk file name as presented on the screen. Proceed to the next set of instructions on removing Boot Protection with a keydisk. Keyboard Lock Additional Information. If a user logs off the network using the Logout command and thereafter keyboard lock activates, the Supervisor can only deactivate PROTEC's keyboard lock. Additional Information, Keyboard Lock for Windows. PROTEC NET also ensures that Windows WIN.INI file is modified properly to include the following statement: LOAD=C:\WINDOWS\KEYTIME.EXE System Verification Additional Information. When a system verification error occurs due to changes in the boot sector, AUTOEXEC.BAT, CONFIG.SYS, COMMAND.COM or DOS's system files, these errors appear within its workstation list within PSECURE.EXE and NETSEC.EXE. To Clear the Verification Error within the Security program 1 Access the Security program or NETSEC.EXE. Refer to Accessing the Security Program for step by step instructions. 2 From the Workstation menu, select System Verification Check (Alt, W, Y). 3 Highlight the appropriate workstation. 4 Press F5 to clear system verification error. When Server is Down or Laptops Additional Information, Master Password. Master Password can only be used when the workstation cannot establish a connection with the network and local PROTEC is not available. Chapter 4 Audits Additional Information on Audit Storage. Audits are stored locally to the PROTEC directory during a user session. When an audit event occurs, the user's primary server is recorded as well as information described within the section Audit Database Structure. Audit records are copied up to the Security Server the next time a user signs onto the workstation. Specifically, the audit records associated with the current user's Primary Server are copied up to its master AUDIT.DBF located in the PROPUBLIC directory. Additional Information on Updating and Converting Audits. The audit data file is reconstructed using new file format when a workstation update occurs. If the Audit database cannot be updated, the file is renamed to AUDIT.OLD and a new local Audit data file is created. The old Audit data file may be converted to a usable, decrypted database or ASCII file using the PROTEC NET utility PCVAUDIT.EXE. Audit Database Structure Page 4-6, Figure 4.5. The Audit database structure has changed to include a new field A_SERVER. Field Name Description Type Width Possible Values VIOLATION Identifies Logical 1 True or False the request as a violation. Logical A_UID Identifies Character 20 Current user name the user who made the request A_UIDGROUP Identifies Character 20 Current user's group name the group to which the user is assigned. A_TIME Stores the Character 12 Current time in time the hours:minutes:seconds:... request microseconds notation occurred. A_DATE Stores the Date 8 Day/Month/Year date the request occurred. A_STATION Specifies the Character 20 Network workstation ID workstation network address. A_SERVER Specifies the Character 48 Server name Security Server to where the record is copied. A_DESCRIPT Provides an Character 128 Depends on request ASCII description of the result of the request. Chapter 5 User Security Master Password Page 5-16. The sentence "You can access each workstation at any time with a master password." should be changed to read "Master Password can be used when the PROTEC NET workstation cannot establish a connection with the network and local PROTEC is not available." Chapter 6 Encryption Additional Information on Directory Encryption. Directories may be specified for automatic encryption. When specified, all files within a directory are encrypted. Subsequently, any file created within the directory is encrypted automatically. Additional Information on Activating Automatic Encryption for a Workstation. In order for a user to access files automatically which are encrypted by PROTEC NET, the Automatic Encryption feature must be activated for the appropriate PROTEC NET workstations. To Activate Automatic Encrytpion 1 Access the Security program. Refer to Accessing the Security Program for step by step instructions. 2 From the Workstation menu, select Automatic Encryption (Alt W, T). 3 Select the workstation you wish to activate automatic encryption and press ENTER. Additional Information on Encrypting Workstation Files. PROTEC NET's automatic encryption utility ENCRYPT.EXE only encrypts resources found on a server not on a local workstation. To encrypt resources on a local workstation and work in conjunction with PROTEC NET's automatic encryption module, use PCRYPT.EXE with the `/ae' parameter to encrypt a file for automatic encryption. The PCRYPT.EXE module could be copied to the workstation's PUBLIC directory so users can encrypt files to which they have access. Page 6-2. The note NOTE If files, directories or drives are specified for automatic encryption, supervisors must logoff the workstation for changes to take affect. should be changed to NOTE The Automatic Encryption module must be activated for each workstation if files or directories are specified for automatic encryption. Chapter 7 Login Scripts Password Management Page 7-3. The example SYNC TRAINING SYNC SALES SSO ON ATTACH TRAINING ATTACH SALES should be replaced by the following example SYNC TRAINING/DAVID SYNC SALES/DAVID SSO ON ATTACH TRAINING ATTACH SALES Login Script Commands ATTACH Page 7-4, ATTACH command. The example SYNC ADMIN SSO ON ATTACH ADMIN should be replaced by the following example SYNC ADMIN/EMMA SSO ON ATTACH ADMIN IF..THEN..ELSE Page 7-5, IF...THEN...ELSE command. The example IF <PROTEC> = "PROTEC" THEN REM These statements are specific to PROTEC's Login program SYNC TEST SSO ON ATTACH TEST SHELL SYS:PUBLIC\WINDOWS\WIN.COM END should be changed to IF <PROTEC> = "PROTEC" THEN REM These statements are specific to PROTEC's Login program SYNC TEST/LUCY SSO ON ATTACH TEST SHELL SYS:PUBLIC\WINDOWS\WIN.COM END SSO Page 7-7, SSO command. The example SYNC TEST SSO ATTACH TEST should be replaced by the following example SYNC TEST/SALLY SSO ATTACH TEST SYNC Page 7-9, SYNC command. The following syntax replaces the syntax found in the Administration manual: Syntax SYNC servername/username Chapter 8 PROTEC NET Programs ADDRESS.EXE Additional Information. ADDRESS presents the workstation's network address in two forms: 1 Network address that should be used to edit a workstation ID within the Security program, PSECURE.EXE. 2 Network address presented as follows: Network Address Node Address Socket Number ENCRYPT.EXE Additional Information. This utility also allows a user to specify directories for automatic encryption. Refer to Automatic Encryption for more information. NETINST.EXE Additional Information. Before using NETINST.EXE, you must be logged or attached to the servers where you wish to install PROTEC NET. PCVAUDIT.EXE Additional Information. If the audit database is not specified then PCVAUDIT looks for AUDIT.DBF in the PROPUBLIC directory. Page 8-18, Parameter audit database, Description column. The sentence "If the filename is different or is not located in the PROTEC directory then specify the filename." should be replaced with the following sentence "If the database is different or is not located in the PROPUBLIC directory then specify the filename." PPERM.EXE Page 8-19, Description. The sentence "Refer to chapter 7 for more details." should be replaced by the following sentence "Refer to User Security for details on setting permissions." PINIT.EXE Page 8-20. The chart below lists an additional database, NAMER.DBF. This chart should replace the parameters' chart found in the Administration Manual. Parameters Value Description method /r Recreates specified databases or all if non specified. /m Recreates missing databases. databases audit.dbf Audit data file program.dbf Application Manager data file gor.dbf Group Access Permissions data file object.dbf Automatic Encryption data file dfiles.dbf Workstation drive data file psys.dat Master Password and general security parameter data file. namer.dbf Workstation security data file. PRIMSRVR.EXE Page 8-26. The following information replaces the Syntax and Parameter information found in the Administration Manual. Syntax PRIMSRVR task1 [filename.ext] PRIMSRVR task2 servername PRIMSRVR task3 servername/username PRIMSRVR task4 servername/username servername/username Parameters Parameters Value Description task1 /s Creates server list to filename.ext. /l Lists all users and their Primary Servers for all Security Servers. /v Verify unique Primary Server for all Security Servers. task2 /g[d] `/g' creates PROTEC_GROUP. `/gd' deletes it. /u[d] `/u' creates the PROTEC_USER. `/ud' deletes it. task3 /a Assign a Primary Server. /d Delete the Primary Server property for the user from the Novell Bindery. Note that users should only have one Primary Server. task4 /c Change a user's Primary Server. Must specify both server names and users. servername1 Any valid NetWare file server. Can be used in conjunction with /a and /c. servername1 corresponds to the Primary Server assigned to the user if none exists or the user's current Primary Server to be changed. servername2 Any valid NetWare file server. Specifies the file server to be a user's Primary Server. username A NetWare user name. Specifies the user whose Primary Server is affected. filename.ext Any valid DOS filename. Contains list of file servers. One server name per line. Used with /s /l and /v. REPORT.EXE Page 8-3, Description. The sentence "Allows users (who have access to REPORT.EXE) and Managers to create the following reports: User, Groups, Programs, Audits, Automatic Encryption and Workstation." should be replaced by the following sentence "Allows any user who has been granted access privileges to REPORT.EXE to create the following reports: User, Groups, Programs, Audits, Automatic Encryption and Workstation." RMPROTEC Additional Information. RMPROTEC removes all PROTEC NET Script programs from all login scripts. UPP.EXE Page 8-34, Description. The sentence "UPP updates information stored on the local workstation such as master and local passwords and local copies of PROTEC." should be replaced by the following sentence "UPP.EXE is responsible for updating the PROTEC NET workstation to the latest version of PROTEC NET located on the Security Server if specified for AutoUpdate. For more information, refer to Install, Update or Remove PROTEC." PROTEC NET Addendum PROTEC NET Addendum Addendum to PROTEC NET Administrator Manual v. 4.1 38 Addendum to PROTEC NET Administrator Manual v. 4.1 37