Novell GROUPWISE 8 - SECURITY POLICIES Manuale utente

Security Policies

XVI

1203

novdocx (en) 22 June 2009

XVII

Security Policies

Chapter 84, “Securing GroupWise Data,” on page 1205

Chapter 85, “Securing GroupWise Agents,” on page 1207

Chapter 86, “Securing GroupWise System Access,” on page 1211

Chapter 87, “Secure Migrations,” on page 1213

Chapter 88, “Undocumented Diagnostic Tools,” on page 1215

1204 GroupWise 8 Administration Guide

novdocx (en) 22 June 2009

Securing GroupWise Data

1205

novdocx (en) 22 June 2009

Securing GroupWise Data

Section 84.1, “Limiting Physical Access to GroupWise Servers,” on page 1205

Section 84.2, “Securing File System Access,” on page 1205

Section 84.3, “Securing Domains and Post Offices,” on page 1205

84.1 Limiting Physical Access to GroupWise

Servers

Servers where GroupWise®data resides should be kept physically secure, where unauthorized

persons cannot gain access to the server consoles.

84.2 Securing File System Access

In ConsoleOne®, Server objects for servers where GroupWise domains, post offices, and agents

reside should be assigned appropriate trustees and rights to prevent access from unauthorized

persons.

For additional data security, encrypted file systems should be used on servers where GroupWise

domains, post offices, and agents reside. Only GroupWise administrators should have direct access

to GroupWise data.

84.3 Securing Domains and Post Offices

In ConsoleOne, administrators in addition to the Admin user should be given rights judiciously, as

described in Chapter 79, “GroupWise Administrator Rights,” on page 1177.

The POA should be configured for client/server access, so that GroupWise users do not require any

direct access to any databases in the post office. For more information, see Section 36.2.1, “Using

Client/Server Access to the Post Office,” on page 498.

1206 GroupWise 8 Administration Guide

novdocx (en) 22 June 2009

Securing GroupWise Agents

1207

novdocx (en) 22 June 2009

Securing GroupWise Agents

Section 85.1, “Setting Up SSL Connections,” on page 1207

Section 85.2, “Protecting Agent Web Consoles,” on page 1207

Section 85.3, “Protecting Agent Startup and Configuration Files,” on page 1207

Section 85.4, “Protecting Agent Log Files,” on page 1208

Section 85.5, “Protecting Agent Processes on Linux,” on page 1209

Section 85.6, “Protecting Trusted Applications,” on page 1209

85.1 Setting Up SSL Connections

All of the GroupWise®agents should be configured to use SSL connections, as described in:

“Securing the Post Office with SSL Connections to the POA” on page 511

“Securing the Domain with SSL Connections to the MTA” on page 643

“Securing Internet Agent Connections with SSL” on page 788

“Securing WebAccess Agent Connections with SSL” on page 897

“Configuring Authentication and Intruder Lockout for the Monitor Web Console” on

page 1023

85.2 Protecting Agent Web Consoles

If you do not provide passwords on the GroupWise agent Web consoles, unauthorized persons can

access them by simply knowing the IP address or hostname of the machine where the agent runs,

along with the HTTP port the agent is using. Set up GroupWise agent Web consoles with passwords

as described in:

“Using the POA Web Console” on page 544

“Using the MTA Web Console” on page 673

“Using the Internet Agent Web Console” on page 805

“Using the WebAccess Agent Web Console” on page 949

“Configuring Authentication and Intruder Lockout for the Monitor Web Console” on

page 1023

85.3 Protecting Agent Startup and Configuration

Files

The startup and configuration files for all GroupWise agents should be protected from tampering.

Agent startup files are found in the following default locations:

1208 GroupWise 8 Administration Guide

novdocx (en) 22 June 2009

Table 85-1 Locations of GroupWise Agent Startup and Configuration Files

85.4 Protecting Agent Log Files

The log files for all GroupWise agents should be protected against access by unauthorized persons.

Some contain very detailed information about your GroupWise system and GroupWise users. Agent

log files are found in the following default locations:

Table 85-2 Locations of GroupWise Agent Log Files

Platform Directory Startup Files

NetWare

sys:\system post_office.poa

domain.mta

gwia.cfg

webac80a.waa

gwdva.dva

Linux

/opt/novell/groupwise/agents/share post_office.poa

domain.mta

gwia.cfg

webac80a.waa

gwdva.dva

monitor.xml

Windows

c:\Program Files\Novell\GroupWise Server\Agents

c:\Program Files\Novell\GroupWise Server\GWIA

c:\Program Files\Novell\GroupWise Server\WebAccess

c:\Program Files\Novell\GroupWise Server\Monitor

post_office.poa

domain.mta

gwia.cfg

webac80a.waa

gwdva.dva

monitor.xml

Platform Directory Startup Files

NetWare

vol:\post_office\wpcsout\ofs

vol:\domain\mslocal

vol:\domain\wpgate\gwia\000.prc

vol:\domain\wpgate\webac80a\000.prc

sys:\system\gwdav.dir\log

mmddpoa.nnn

mmddmta.nnn

mmddgwia.nnn

mmddweb.nnn

mmdddva.nnn

Linux

/var/log/novell/groupwise/post_office.poa

/var/log/novell/groupwise/domain.mta

/var/log/novell/groupwise/domain.gwia

/var/log/novell/groupwise/domain.webac80a

/var/log/novell/groupwise/gwdva

/var/log/novell/groupwise/gwmon

mmddpoa.nnn

mmddmta.nnn

mmddgwia.nnn

mmddweb.nnn

mmdddva.nnn

mmnnmon.nnn

mmnnhist.nnn

Securing GroupWise Agents 1209

novdocx (en) 22 June 2009

85.5 Protecting Agent Processes on Linux

On Linux, the GroupWise agents are installed to run as the

root

user by default. This is not a secure

configuration. Immediately after installation, you should set up a non-

root

user for the agents to run

as, as described in “Running the Linux GroupWise Agents As a Non-root User” in “Installing

GroupWise Agents” in the GroupWise 8 Installation Guide.

85.6 Protecting Trusted Applications

Trusted applications are third-party programs that can log in to POAs and Internet Agents in order to

access GroupWise mailboxes. For background information, see Section 4.12, “Trusted

Applications,” on page 74.

Trusted applications log in to GroupWise agents by using trusted application keys that are created

when the trusted application is created. It is essential that these keys are protected and not allowed to

become public. Steps you can take to protect trusted application keys include:

Associating the trusted application key with a single IP address whenever possible

Reviewing third-party log files for sensitive data such as the key before sharing them with

others

Not sharing trusted application keys with others for any reason

Removing old keys that are no longer needed

Windows

\post_offce\wpcsout\ofs

\domain\mslocal

\domain\wpgate\gwia\000.prc

\domain\wpgate\webac80a\000.prc

c:\Program Files\Novell\GroupWise Server\

WebAccess\gwdva.dir\log

c:\Program Files\Novell\GroupWise Server\Monitor

mmddpoa.nnn

mmddmta.nnn

mmddgwia.nnn

mmddweb.nnn

mmdddva.nnn

mmnnmon.nnn

mmnnhist.nnn

Platform Directory Startup Files

1210 GroupWise 8 Administration Guide

novdocx (en) 22 June 2009

Securing GroupWise System Access

1211

novdocx (en) 22 June 2009

Securing GroupWise System

Access

Section 86.1, “Using a Proxy Server with Client/Server Access,” on page 1211

Section 86.2, “Using LDAP Authentication for GroupWise Users,” on page 1211

Section 86.3, “Managing Mailbox Passwords,” on page 1211

Section 86.4, “Enabling Intruder Detection,” on page 1212

86.1 Using a Proxy Server with Client/Server

Access

POAs in your GroupWise®system should be located behind your firewall. If GroupWise client

users want to access their GroupWise mailboxes from outside your firewall using the Windows

client or the Linux/Mac client, you should set up a proxy server outside your firewall to provide

access, as described in Section 36.3.1, “Securing Client/Server Access through an External Proxy

Server,” on page 509. WebAccess client users access their GroupWise mailboxes through their Web

browsers, so your Web server handles the access issues for such users.

86.2 Using LDAP Authentication for GroupWise

Users

LDAP authentication provides a more secure method of mailbox access than standard GroupWise

authentication, which is the default when you set up your GroupWise system. Therefore, you should

implement LDAP authentication, as described in Section 36.3.4, “Providing LDAP Authentication

for GroupWise Users,” on page 514.

On the Post Office object, the LDAP username that you provide on the Security property page

should be granted only browser rights in the eDirectory tree. The password for the LDAP user

should be long and randomly generated.

On the LDAP Server object, Require TLS for All Operations should be selected on the SSL/TLS

Configuration property page. On the LDAP Group object, Require TLS for Simple Binds with

Password should be selected.

On your LDAP servers, the trusted root certificate file should be write protected so that it cannot be

tampered with.

86.3 Managing Mailbox Passwords

GroupWise offers varying levels of password security, as described in Section 74.1, “Mailbox

Passwords,” on page 1151. Make sure that you understand the options available to you and that you

select the level of password security that is appropriate to your GroupWise system.

1212 GroupWise 8 Administration Guide

novdocx (en) 22 June 2009

86.4 Enabling Intruder Detection

You can configure the POA to lock out a user that provides the wrong mailbox password too many

times, as described in Section 36.3.5, “Enabling Intruder Detection,” on page 519.

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Novell Software

Novell

Novell IDENTITY MANAGER 3.6.1 - STAGING BEST PRACTICES GUIDE... Manuale utente

Novell

Novell CLIENT FOR LINUX 1.2 Manuale utente

Novell

Novell EDIRECTORY 8.8 SP3 Manuale utente

Novell

Novell EDIRECTORY 8.8 SP2 Manuale utente

Novell

Novell CLIENT FOR LINUX 1.2 Manuale utente

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Manuale di istruzioni

Novell

Novell GROUPWISE 7 - INTERNET AGENT Manuale utente

Novell

Novell CLIENT FOR LINUX 2.0 Manuale utente

Novell

Novell APPARMOR - AND Manuale utente

Novell

Novell PRODUCT NAME 10.3 - DEPLOYING ZENWORKS ON CITRIX SERVER BEST PRACTICES GUIDE... Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - E-MAIL Manuale utente

Novell

Novell GROUPWISE 7 - DATABASES Manuale utente

Novell

Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - ... Manuale utente

Novell

Novell APPARMOR 2.0.1 Manuale di istruzioni

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 9.3 - ADMINISTRATION... Manuale utente

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manuale utente

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.0 -... Manuale utente

Novell

Novell PLATESPIN PORTABILITY SUITE 8.1 Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... Manuale utente

Novell

Novell SENTINEL RAPID DEPLOYMENT 6.1 - INSTALLATION GUIDE... Manuale utente

Novell

Novell GROUPWISE 8 - DISTRIBUTION LISTS Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... Manuale utente

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 2 Manuale utente

Novell

Novell EDIRECTORY 8.8 - GUIDE Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio