Chapter: 1 | 2 | 3 | 4 | 5 | 6
MCSE SQL Server 7 Administration Study Guide
Syngress, Inc.
 $49.99  007-211-90-47


Chapter 2

Enabling Network Access

Certification Objectives

One of the first things end users do when they arrive at the enterprise network, is log in. Logging in gives them access to files, printers, e-mail, databases, and other network resources. Some enterprises require that no data be kept anywhere but on the servers, and in those enterprises, the only way that an end user can get to work is by logging in. There are several things that an administrator has to provide in order to enable login authentication:

Enabling Network Communication (IPX/IP)

In order for workstations to access network resources, they need a method of communication with the server. This method of communication is a protocol. Older versions of NetWare used only the Internet Packet Exchange/Sequenced Packet Exchange (IPX/SPX) protocol. Administrators have added Transmission Control Protocol/Internet Protocol (TCP/IP), the protocol used on the Internet, to satisfy the growing need for businesses to communicate with the Internet. The result is that NetWare networks must run multiple protocols. There is a perception that TCP/IP is easier to maintain since routers are optimized for Internet traffic. So, with NetWare version 5, Novell has stepped up to the challenge and begun to provide TCP/IP as a base communications protocol for NetWare networks. IP compatibility mode can run on a NetWare 5 server, and all IPX dependencies are no longer present. The IP compatibility mode can run on a NetWare client using an IP compatibility mode driver, allowing the client to access any NetWare server running IP compatibility mode.

Workstations access the network through client software. NetWare 5 comes with client access software for many different workstation operating systems, including DOS, OS/2, Microsoft Windows 95/98, and Microsoft Windows NT 4.

Client 32 Overview

When Microsoft introduced Windows 95, Novell immediately followed with the NetWare Client 32. The 32 stands for 32-bit, which means that the client software is not a standard DOS or Windows 3.x 16-bit application. Microsoft Windows 95 already included a 32-bit client for NetWare, but Novell’s version came with additional access components. For example, Microsoft’s initial version did not allow the end user to browse the NDS tree; it was only a bindery-compatible client. Novell’s version was immediately compatible with NDS.

Client 32 was popular due to the graphical utilities and speed. Novell then created a Client 32 for DOS and Windows 3.1x. And after Microsoft released Windows NT 4, Novell released a 32-bit client for that operating system.

Client 32 requires the following workstation components:

Client 32 includes several software components called NetWare Loadable Modules (NLMs). Client 32 supports the NetWare Open Data-link Interface (ODI) specification. ODI is a modular client specification, allowing multiple protocols to be used with a single NIC. It requires four components for network connectivity:

On the Job: An older ODI client software from NetWare was the Virtual Loadable Module (VLM) software. VLMs were DOS 16-bit client software pieces.

Multiple Link Interface Driver (MLID)

The MLID is the software that transmits data onto the network through the Network Interface Card (NIC). It communicates directly with the NIC hardware. This software component is different for each NIC used. For example, an Ethernet card will not use the same NIC driver software as a Token-Ring card, and the driver for various Ethernet cards may be different between vendors or even types of cards from the same manufacturer. Even though the MLID is an NLM, the file does not use the .NLM extension. Instead it uses a .LAN extension. This represents the Physical layer of the OSI (Open Systems Interconnection) protocol stack model.

On the Job: Sometimes using the ODI drivers for the NetWare Client 32 causes access problems with existing client software for Microsoft NT networks. This is normally due to the MLID driver not being compatible with the other network client software. In order to force Client 32 to install using an existing (and already functioning MLID) NIC driver, use the /N switch after invoking setup. This forces Client 32 to use the existing Microsoft client NIC driver and keeps the Microsoft client software working correctly. On the other hand, if you want to force an ODI driver, use the /O switch.

Link Support Layer

The Link Support Layer (LSL) communicates at the Data Link layer of the OSI model. This connection between the IPX or IP protocol and the MLID is handled by LSLC32.NLM.

IPX Protocol or IP Compatibility Protocol

IPX.NLM and IPHLPR.NLM provide the IPX and IP protocols. These protocols work at the Network layer of the OSI model. They transmit data between the NetWare client software and the Link Support Layer.

NetWare Client Software

Network applications interface directly with the NetWare client software (see Figure 2-1), which can work at the upper layers of the OSI protocol stack reference model. These layers are all above the Network layer—Transport, Session, Presentation, and Application. This software enables the mapping of drives, capturing network printers, and access to other network resources. The Client 32 is NDS-compliant, and allows NDS applications such as the NetWare administrator or NDS Manager to run on the workstation. Bindery-based client software will not allow the workstation to browse the NDS tree, or run any other NDS utilities.

Figure 1: Modular software communication for Client 32

Exam Watch: The four components needed to supply client access to NetWare’s ODI specification are, in this order, MLID, LSLC32.NLM, IPX.NLM/IPHLPR.NLM, and CLIENT32.NLM.

All Client 32 software can install automatically using existing configuration or newly edited configuration files. The command is SETUP /ACU. The /ACU switch stands for Automatic Client Update and is also used for upgrading an existing Client 32 installation.

Client 32 Installation Procedure for Windows 95

There are a few different ways to install Client 32 on a workstation:

The most common installation is run over the network and attending the setup. This usually involves the administrator copying the installation files to a network server volume. Table 2-1 depicts the optional components available with the Windows 95 version client.

Component

Description

Novell Workstation Manager

A single administrative utility for managing user and desktop information

Novell Distributed Print Services (NDPS)

A new printing service enabling bi-directional, real-time communication with network printers

Novell NetWare/IP Protocol

Support for NetWare/IP requester networks

Novell SNMP Agent

SNMP agent that works on both IPX and IP networks

Host Resources MIB

Enables a management console to poll SNMP clients for inventory information

Network Management Responder (NMR)

Supplies operating system, BIOS, and other information to the management console

Novell Target Service Agent (TSA)

Used for backing up workstations

Novell NDS Provider for Active Directory Service Interfaces (ADSI)

Enables ADSI client applications to access NDS information

Novell Remote Control Agent

Allows other workstations to take control remotely of this workstation

Table 1: Optional Windows 95 Client Components

Exercise 2-1 outlines the process for installing the Client 32 on a Windows 95 workstation.

Exercise 2-1 Windows 95 Client 32 Installation

  1. To access the Client 32 setup files, place the CD in a server’s shared CD-ROM drive.
  2. Access the server’s CD-ROM drive by browsing in the Network Neighborhood; or right-click the Network Neighborhood, selecting Map Network drive, and type in the name of the resource in the format: \\SERVER\CDROM_VOLUME_NAME.
  3. The English language setup files for Windows 95 are in the path PRODUCTS\WIN95\IBM_ENU on the NetWare 5 installation CD-ROM. Run the SETUP.EXE file from this location.
  4. The first screen to appear is the license acceptance, as shown in Figure 2-2. Click Yes.
  5. Figure 2: Client 32 license screen

  6. There are two options for installation: Typical and Custom. If using a standard IPX network, the Typical installation is usually sufficient. However, to view all the possible installation options, select Custom now and click Next.
  7. The next screen depicts the IP addition to NetWare networking. The possible selections are IP, IP & IPX, and IPX (see Figure 2-3). Select the appropriate protocols, and click Next.
  8. Figure 3: Protocol options

  9. The next option is to install an NDS-compatible or bindery-compatible client. For NetWare 5, select the NDS option and click Next.
  10. NetWare has several components available to install, as illustrated in Figure 2-4. Click the appropriate options and click Install.
  11. The client installs and then prompts to reboot. After rebooting, the setup is complete.

Figure 4: Optional components

Client 32 Installation Procedure for Windows NT

Exercise 2-2 outlines the installation procedure for the Client 32 software on Microsoft Windows NT 4. The client can be loaded over the network, if the Microsoft Client Service for NetWare is loaded, in both an attended or unattended mode. The client can be integrated with a network installation of Windows NT, or manually installed from diskettes or CD.

Client 32 for NT uses the IPX/SPX compatible protocol that comes as part of the Windows NT operating system. It is recommended, but not necessary for diskette or CD installs, that the Microsoft Client Service for NetWare be set up prior to installing Client 32. To verify that it is installed, right-click on the Network Neighborhood and select Properties. Click the Services tab to view which clients are installed (see Figure 2-5).

Figure 5: Client Service for NetWare

Exercise 2-2 Microsoft Windows NT 4 Client 32 Installation

  1. From the Network Neighborhood, browse to the shared CD-ROM where the NetWare 5 installation CD resides. Open the PRODUCTS\WINNT\I386 folder and double-click the SETUPNW.EXE program. You may also click Start | Run and type in the full path to the SETUPNW program, then press Enter.
  2. The first screen is the software license agreement. Accept the agreement and click Next.
  3. As shown here, the Client 32 software will notify you that it is removing the existing Microsoft Client Service for NetWare. Click Yes.
  4. Illustration 1

  5. Not only is the existing client removed, but new keys are added to the registry and files are copied to the workstation hard drive.
  6. After the Client is installed, it prompts to reboot or close the installation program. In order for the Client to work, the workstation must be rebooted, so select reboot.

Login Concepts

There are several different security controls in NetWare:

The authentication process manages login security. Authentication is configured through the restrictions and rules set within NDS, with properties of objects such as users who log in and container objects that contain user objects somewhere beneath them.

Restrictions in NDS

Several NDS restrictions establish network security. The Login Restrictions properties in the User object (see Figure 2-6) enable the administrator to restrict whether a user may log in at all. The administrator may disable the ID, force it to expire on a given date, or limit how many concurrent logins the user may have.

Figure 6: Login Restrictions properties for User objects

The Password Restrictions properties allow the administrator to establish password policies on a per-user basis. The administrator may set whether a user can change their password, how often the password will be required to change, or how many grace logins the user is allowed with the old password before they must change it.

From the Classroom

Backing Up Wisely

Deciding whether or not to back up the file system is not hard. What is usually a less obvious, yet critical, decision is what to do with the NDS database. Don’t forget to back it up. True, it is a distributed, replicated database, but waiting for the synchronization to happen between replicas can be time-consuming and crowd the bandwidth while critical information is being updated, especially if done over WAN links. Including NDS as part of the backup is prudent and saves time in the long run, particularly if you've ever experienced a catastrophic disk failure on a server containing several partitions worth of Master Replicas and have to restore everything.

By Dan Cheung, CNI, MCNE, MCT

Login Time Restrictions properties offer the administrator a method of restricting logins on a time basis. Login time restrictions are used for handling daily backups or weekly scheduled maintenance of the servers. They effectively avoid some loss of data by making sure that no files are open when other processes need to access them or when the server is suddenly taken offline. In Figure 2-7, the shaded area shows that logins are restricted between 12:00 a.m. and 3:30 a.m. each weekday.

Figure 7: Example of a login time restriction

A network address restriction uses the network node address of a workstation, and limits the network access for a user to only the workstations having those addresses listed. For high-security networks, using a network address restriction can make sure that a user does not login without authorization.

Intruder Detection

An intruder is anyone who attempts to log in to the network using an invalid password. NetWare can lock an account when an invalid password is used too many times for a user ID. This is to protect the network from hackers trying to figure out a password.

On the Job: Intruder detection is both a blessing and a curse. One thing for sure, it definitely works. The problem is that many users forget their password, or mistype it too many times and unintentionally lock themselves out. Most do not realize that they have locked their user ID and call the administrator or the help desk to ask why the network is down. If you intend to use intruder lockout, this is simply one of the added administrative tasks to be aware of, and one of the first things to look at when a user calls about not being able to log in.

Intruder detection is established in a container object, through the Intruder Detection property, as demonstrated in Figure 2-8. The default settings are not to detect intruders. There are two reset intervals. The intruder attempt reset interval is the length of time to wait before starting to count the number of incorrect password attempts again. For example, if Joe is allowed seven incorrect login attempts, and the intruder attempt reset interval is 30 minutes, then the 30-minute period starts from the first bad login attempt. Joe can try six times in a 30-minute period to log in with the wrong password and not lock out the user account.

Figure 8: Establishing intruder detection in an organizational unit

The intruder lockout reset interval kicks in after the user account has been locked out. If Joe has been locked out of his account, and the intruder lockout reset interval is 15 minutes, then he can wait 15 minutes. At that point in time, the user account will no longer be locked out, and provided he knows the correct password, Joe may log in.

Login Process

Novell Directory Services enables users to have a single login to gain access to any enterprise-wide network resource. Authentication is the process that enables the single login capability.

When a user logs in to the network, it may appear that the password is sent to the server and that the server clears the user for access. However, for security reasons, the password is not sent across the network. Instead, an encrypted user code of the user’s information—including user name, password, workstation, and other details—is created from the login process. The authenticating server performs the same process to create a user code. The server compares its user code to the workstation version and, if it matches, the user is granted access.

On the Job: Note that the authenticating server will perform the comparison of the user code. The authentication process is a key concept in network design. In one global network I worked on, I found that every third login attempt I made ended up being authenticated in Sydney, Australia, even though I was in Phoenix, or in Miami. It turned out that the partitioning scheme had not been completed in Phoenix, but had been completed in Sydney. As a result, there were more servers with replicas of my user ID’s context sitting in Sydney. They authenticated more often because there were more of them available for authentication even though the slow bandwidth might normally prevent this from happening. Once the partitioning scheme was completed in Phoenix and Miami, the Sydney-authentication-syndrome stopped occurring.

As illustrated in Figure 2-9, when a user logs in there are several scripts that will be run in a specific order.

  1. Container login script The script defined in the container object that the user resides in
  2. Profile login script A script that is in a Profile object and assigned to a user
  3. User login script A script that is written in the Login Script property of the User object itself
  4. Default login script A script that will run if NetWare does not find a user login script for the User object

Figure 9: Logical cascade of login scripts

The following is a list of commands found in the default login script:

MAP DISPLAY OFF
MAP ERRORS OFF
REM (Set first drive to most appropriate directory.)
MAP *1:=SYS
MAP *1:=SYS:%LOGIN_NAME
IF "%1"="SUPERVISOR" THEN MAP *1:=SYS:SYSTEM
MAP S1:=SYS:PUBLIC
MAP S2:=S1:%MACHINE\%OS\%OS_VERSION
MAP DISPLAY ON
MAP

Justine is the administrator of a NetWare 5 network. She has created a profile script that runs a CAPTURE command for the Graphics Department’s color laser printer. Justine then assigns the profile script to the users within the Graphics Department. There is no container script or user script being run. When Justine tests the script, she gets an error that the external command CAPTURE cannot be executed. CAPTURE is in the Public directory, and when Justine checks, there is a mapping to SYS:PUBLIC. Why does she get this error and how can she fix it?

Justine was depending on the default login script to provide the mapping to the Public directory. However, because the profile script executes before the default login script, it did not have a mapping to SYS:PUBLIC when it was trying to find the CAPTURE command. In order to fix this, Justine can add the Search drive mapping to the profile script. Or, to prevent errors like this from happening in the future, she can place the commands she wants to have in the container script for all users and add the NO DEFAULT line so that the default script will not run for users in that container.

Browser Client Installation

A Web browser, Netscape Navigator 4.04 , is part of the client installation options on the NetWare 5 CD. The steps for installing the browser client are outlined in Exercise 2-3.

Exercise 2-3 Netscape Navigator 4.04 Installation

  1. Open the Network Neighborhood and locate the server with the shared CD-ROM where the NetWare 5 CD resides.
  2. Open the Products folder, then the Netscape folder, the Win32 folder, and finally the English folder.
  3. Double click on the N32E404.EXE file. Netscape will install automatically.

Previous versions of NetWare did not include a Web browser. The need simply was not prevalent in an IPX-based network. With Internet and intranet access needs becoming more accepted in networks, including a Web browser on a client workstation has become necessary. This completes the client software needed to access a NetWare 5 server configured as a Web server. New to NetWare 5 is the publishing of Help files and server documentation in HTML (Hypertext Markup Language) format. To view the documentation, a Web browser is required.

Certification Summary

The communication between the workstation and the server is through a protocol. NetWare 5 can use both the IPX protocol and the IP protocol from the client to access a server running the same protocol. The IP protocol is new to NetWare 5 in the sense that the server and the workstation do not need to have IPX running for network access.

Client 32 is a 32-bit software application that is available for DOS, Windows 3.1x, Windows 95/98, and Windows NT 4 workstations.

Client 32 has four components for network communication that translate to a layer of the OSI reference model for protocol stacks. The specification for the four components is called ODI, or Open Data-link Interchange. These four components are

  1. MLID (Multiple Link Interface Driver) Physical layer
  2. LSL (Link Support Layer) Data Link layer
  3. IPX or IP (Protocol) Network layer
  4. Client 32 (Client access software) Upper layers of the protocol stack: Transport, Session, Presentation, and Application

The applications that provide the components are called NetWare Loadable Modules (NLMs). The files that provide each layer are .LAN files for the MLIDs specific to the cards being loaded. This file is still an NLM even though the file has a .LAN extension. LSLC32.NLM provides Link Support Layer communication. IPX.NLM and IPHLPR.NLM provide Network layer services. CLIENT32.NLM supplies the client access software interface and upper layers.

The Windows 95 Client 32 can be installed from CD or diskette, over the network, and can be integrated with an installation of Windows 95/98. The installation can run in an unattended mode using a switch after the setup program. The command is SETUP /ACU. The /ACU switch stands for Automatic Client Update and is used for upgrading an existing Client 32 installation.

Windows 95 setup files for Client 32 are located on the NetWare 5 CD-ROM. It is typical for an administrator to copy them to a network server for installation.

Windows NT setup files for Client 32 are located in a different directory on the CD. The setup executable for the NT version of Client 32 is SETUPNW.EXE.

Login security within NetWare is above and beyond file security and NDS security. Properties of user objects and container objects will configure how login security works. These things include password restrictions, login time restrictions, intruder detection, and network address restrictions.

The login process begins with authentication. The user’s password is never sent over the network wire. Instead, a complex process at the workstation creates an encrypted package of the user’s information and typed-in password. The server is notified of the login attempt and creates the same encrypted package and compares it to the one from the workstation. A match allows the login to occur. Once the user logs in, the authenticating server will check for a container login script and run it, if there is one. Then it will look for a profile script and run it, if there is one, and for a user login script and run it, if there is one. If there is no user script, the login process will run a default login script.

To provide the network an access method to HTML documents, NetWare 5 comes with Netscape Navigator, version 4.04.

Two-Minute Drill

Self Test

The following Self-Test questions will help you measure your understanding of the material presented in this chapter. Read all the choices carefully, as there may be more than one correct answer. Choose all correct answers for each question.

  1. What are NLMs?
    1. NetWare Link Multistations
    2. Novell Link Multistations
    3. Nameable Loaded Machinations
    4. NetWare Loadable Modules
  2. What is the ODI specification?
    1. Open Data-link Interchange—a modular approach to client software
    2. Open Systems Interconnection—a standard for the protocol reference model
    3. Open Shortest Path First—a TCP/IP routing protocol
    4. Overrun Data Interrupt—a way to prevent excessive data on the network during login
  3. When using ODI with four protocols: DLC, TCP/IP, IPX/SPX, and NetBEUI, how many NICs are required?
    1. 4
    2. 2
    3. 1
    4. 0, can’t be done
  4. Which of the following is the NLM known as an MLID?
    1. LSLC32.NLM
    2. CLIENT32.NLM
    3. IPX.NLM
    4. TOKEN.LAN
  5. What OSI reference model layers does the CLIENT32.NLM handle?
    1. Physical and Data Link
    2. Network only
    3. Transport, Session, Presentation, and Application
    4. Application only
  6. What is the order for the ODI components?
    1. MLID, LSL, IPX or IP, CLIENT32
    2. LSL, MLID, IPX or IP, CLIENT32
    3. CLIENT32, MLID, IPX or IP, LSL
    4. IPX or IP, CLIENT32, LSL, MLID
  7. True or False. When installing Client 32 on a Windows 95 workstation, NDPS is automatically part of the installation.
    1. True
    2. False
  8. Taylor is the network administrator for a large network. Frequently, she is requested by HR to remove accounts for users because they are going on leave. Just as frequently, she is then notified to re-create the accounts, add the old permissions, and re-establish the same properties as the user had before. This is a login security requirement, because HR policy states that users on leave are not allowed to log in to the network while on leave. Can Taylor make this process easier, yet still maintain the HR policy?
    1. Yes, she can do so by managing the Intruder Detection property of the end user’s container.
    2. Yes, she can do so by managing the Login Restrictions property for Account Disabled of the end user’s object.
    3. No; it cannot be done.
    4. Yes, she can do so by managing the root object of the tree.
  9. Every night at 2:00 am, the backup of three NetWare servers takes place on Dan’s network. Dan has enabled remote access services, and occasionally a user will be logged in at that late hour. The backup process fails if it finds too many open files, which Dan finds out will happen when a user is logged in. How can Dan manage the backup so that it does not fail, plus provide maximum hours of remote access?
    1. He can turn off the remote access modems each night and turn them on in the morning.
    2. He can mark each remote user’s account as Disabled before he leaves for the night.
    3. He can edit the remote user’s login time restrictions and mark off the time period that the backup takes place.
    4. He cannot do this.
  10. Gordon is the teacher in a class that uses a NetWare network for training users on applications. The classroom container login script looks at the node address of the NIC in order to map the workstation to specific files that the student worked on last. Gordon wants to make sure that students do not log in to other people’s workstations. Can he do this?
    1. Yes, he can do this by editing the network address restrictions of the users.
    2. Yes, he can do this by editing the container login script further.
    3. Yes, he can do this by editing the login time restrictions of the users.
    4. No; it cannot be done.
  11. Where do intruder detection policies get established?
    1. In each User object
    2. In a Group object
    3. In the public trustee
    4. In the container object
  12. The PHX organizational unit has set the intruder detection lockout to start after four incorrect login attempts during a 20-minute period and to last for 4 hours. Joe.PHX.MA has forgotten his password. He tries a couple of times to log in, gives up, and goes to an hour-long meeting. When he comes back, he tries three more times, and then gets it right on the fourth attempt and logs in. Why didn’t his account get locked out?
    1. Because it was locked out for 20 minutes and then was available again automatically
    2. Because he never had four incorrect passwords during a 20-minute period, and the intruder attempt reset interval was changed from 2 to 0 when 20 minutes passed since the first login attempt
    3. Because intruder detection was disabled
    4. Because the intruder detection was set for the PHX organizational unit container, not the MA organization container
  13. Terry works for a bank that has strict security policies. He is considering putting NetWare 5 servers into the network, but is concerned that sniffers can grab people’s passwords, which would violate security. How can you respond to Terry’s concern?
    1. Tell Terry about the login process of authentication that uses an encrypted user code and never sends a user’s password over the wire.
    2. Tell Terry about a new product, NetSecure, that can be added to encrypt all end-user traffic, including password authentication.
    3. Tell Terry how all other network operating systems have the same type of login scenario.
    4. Tell Terry that there is really nothing that can be done about capturing passwords on the wire.
  14. When a user logs in to the NetWare network, the following scripts are run in the following order:
    1. Default login script; system login script; user login script
    2. System login script; user login script; or if there is no user script, the default login script
    3. Container login script, if it exists; then profile login script, if it exists; then user login script, if it exists; or if there is no user script, the default login script
    4. Profile script, if it exists; container login script or the default script, if there is no container script; user login script
Backward Forward
Chapter: 1 | 2 | 3 | 4 | 5 | 6