Novell IFOLDER 3.8 - CROSS-PLATFORM Manuale utente

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Novell iFolder 3.8 Security Administration Guide

iFolder

3.8

November 2009

Security Administration Guide

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please

refer to the Novell International Trade Services Web Page (http://www.novell.com/info/exports/) for more

information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary

export approvals.

document under the terms of the GNU Free Documentation License (GFDL), Version 1.2 or any later version,

published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover

Texts. A copy of the GFDL can be found at the GNU Free Documentation Licence (http://www.fsf.org/licenses/

fdl.html).

THIS DOCUMENT AND MODIFIED VERSIONS OF THIS DOCUMENT ARE PROVIDED UNDER THE

TERMS OF THE GNU FREE DOCUMENTATION LICENSE WITH THE FURTHER UNDERSTANDING THAT:

1. THE DOCUMENT IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER

EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE DOCUMENT

OR MODIFIED VERSION OF THE DOCUMENT IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A

PARTICULAR PURPOSE, OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY, ACCURACY,

AND PERFORMANCE OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS WITH

YOU. SHOULD ANY DOCUMENT OR MODIFIED VERSION PROVE DEFECTIVE IN ANY RESPECT, YOU

(NOT THE INITIAL WRITER, AUTHOR OR ANY CONTRIBUTOR) ASSUME THE COST OF ANY

NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES

AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED VERSION OF THE

DOCUMENT IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER; AND

2. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING

NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE AUTHOR, INITIAL WRITER, ANY

CONTRIBUTOR, OR ANY DISTRIBUTOR OF THE DOCUMENT OR MODIFIED VERSION OF THE

DOCUMENT, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY

DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER

INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE,

COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR LOSSES ARISING

OUT OF OR RELATING TO USE OF THE DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT,

EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

novdocx (en) 13 May 2009

www.novell.com

Online Documentation: To access the online documentation for this and other Novell products, and to get

updates, see the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For a list of Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/

legal/trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 7

1 Security Best Practices Overview 9

1.1 Security Recommendations for iFolder 3.7 and Later Versions . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Security Best Practices for Novell iFolder 3.7 and Later Versions 11

2.1 Secure Communication with the LDAP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1.1 Using SSL for Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2 Communication between the Web Admin Server and the Web Admin Browser . . . . . . . . . . . 12

2.3 Enterprise Client/Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.4 Web Access Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.5 Disabling the SSL 2.0 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.6 Configuring a Cipher Suite to Use for SSL/TLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.7 Installing Trusted Roots and Certifications on the iFolder Server . . . . . . . . . . . . . . . . . . . . . . 13

2.8 Installing Server Certificates from a Known Certificate Authority. . . . . . . . . . . . . . . . . . . . . . . 13

2.9 Using a Shared Certificate in iFolder Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.10 Ensuring Privilege Separation for the iFolder Proxy User . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.11 Using Synchronize Now to Remove Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.12 Controlling Access to the iFolder Data Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.13 Controlling Access to the iFolder Server Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.14 Controlling Access to And Backing Up the iFolder Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . 14

2.15 Encrypting Data on the Server for iFolder 3.7 and Later Versions. . . . . . . . . . . . . . . . . . . . . . 15

2.16 Preventing the Propagation of Viruses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

2.17 Backing Up the iFolder Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

2.18 Loading the Recovery Agent Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3 Security Best Practices for the iFolder Client 17

3.1 Configuring Client-Side Firewalls for iFolder Communications . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2 Configuring Client-Side Virus Scanners for iFolder Communications . . . . . . . . . . . . . . . . . . . 17

3.3 Configuring a Web Browser to Use SSL 3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.4 Creating an Encrypted iFolder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.5 Using the Recovery Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.6 Transferring the Encryption Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

4 Other Security Best Practices 19

4.1 Controlling Physical Access to the iFolder Servers and Resources. . . . . . . . . . . . . . . . . . . . . 19

4.2 Securing Access to the Servers with a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.3 Securing Communications with a VPN If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.4 Securing Wireless LAN Connections If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.5 Creating Strong Password And Passphrase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

A Documentation Updates 21

A.1 December 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

6Novell iFolder 3.8 Security Administration Guide

novdocx (en) 13 May 2009

A.2 December 2007 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

A.3 October 2007 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

A.4 August 15, 2006 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

A.5 November 1, 2005 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

About This Guide 7

novdocx (en) 13 May 2009

About This Guide

This guide provides specific instructions on how to install, configure, and maintain Novell®

iFolder®and iFolder clients for versions 3.7 and later in the most secure way possible.

Chapter 1, “Security Best Practices Overview,” on page 9

Chapter 2, “Security Best Practices for Novell iFolder 3.7 and Later Versions,” on page 11

Chapter 3, “Security Best Practices for the iFolder Client,” on page 17

Chapter 4, “Other Security Best Practices,” on page 19

Appendix A, “Documentation Updates,” on page 21

Audience

This guide is intended for network security administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comment feature at the bottom of each page of the

online documentation, or go to Novell Documentation Feedback (http://www.novell.com/

documentation/feedback.html) and enter your comments there.

Documentation Updates

For the most recent version of the Novell iFolder 3.x Security Administrator Guide, visit the Novell

iFolder 3.x documentation Web site (http://www.novell.com/documentation/ifolder3/index.html).

For emerging issues with Novell iFolder and client for versions 3.7 and later, see the Novell iFolder

3.8 Readme (http://www.novell.com/documentation/ifolder3/index.html).

Additional Documentation

Novell iFolder 3.xdocumentation (http://www.novell.com/documentation/ifolder3/index.html)

Novell Technical Support (http://www.novell.com/support/)

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Novell iFolder 3.8 Security Administration Guide

novdocx (en) 13 May 2009

Security Best Practices Overview

novdocx (en) 13 May 2009

Security Best Practices Overview

This section summarizes the recommended configurations and settings required to run Novell®

iFolder®and the iFolderTM client for versions 3.7 and later in a secure mode.

Section 1.1, “Security Recommendations for iFolder 3.7 and Later Versions,” on page 9

1.1 Security Recommendations for iFolder 3.7

and Later Versions

The following table lists the iFolder server configuration settings that impact iFolder security.

Table 1-1 Security Recommendations

Parameter Possible Values Default Value Recommended Value for

Best Security

iFolder Admin user User-specified User-specified

administrator user

Special iFolder Admin

user identity for

managing iFolder

services

Equivalent iFolder

Admin users

User-specified None Users with limited

administrator rights,

such as for a specific

iFolder server

iFolder Proxy user

password

User-specified Auto generated during

initial configuration of the

iFolder server

User-specified, using

strong password

practices

Server to client

communications

SimiasRequireSSL (Yes/

No)

SimiasRequireSSL =

Yes

SimiasRequireSSL =

Yes

Server to Server

Communication

Select Yes during setup

to enable SSL, or select

No to disable SSL

Yes, SSL enabled

SimiasUrl https

SimiasCert <RAW

certificate>

Yes, SSL enabled

/usr/web/

web.config

file

SimiasUrl (https/http)

SimiasCert (RAW

certificate/none)

SimiasRequireSSL https

SimiasCert <RAW

certificate>

SimiasRequireSSL https

SimiasCert <RAW

certificate>

10 Novell iFolder 3.8 Security Administration Guide

novdocx (en) 13 May 2009

Altri manuali per IFOLDER 3.8 - CROSS-PLATFORM

Indice

Altri manuali Novell Software

Novell

Novell ACCESS MANAGER 3.1 SP2 IR1 - README 07-2010 Manuale utente

Novell

Novell APPARMOR - AND Manuale

Novell

Novell SENTINEL RAPID DEPLOYMENT 6.1 - INSTALLATION GUIDE... Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - PREBOOT SERVICES AND IMAGING REFERENCE 10.3... Manuale di istruzioni

Novell

Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT Manuale utente

Novell

Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION... Manuale utente

Novell

Novell SUSE LINUX ENTERPRISE SERVER 10 STORAGE Manuale utente

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - TASK SERVICE DRIVER Manuale utente

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - UPGRADING TO OES-PLANNING AND IMPLEMENTATION GUIDE... Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 10 Manuale utente

Novell

Novell APPARMOR 1.2 - QUICK GUIDE AND Scheda tecnica

Novell

Novell IMANAGER 2.7.3 Manuale di istruzioni

Novell

Novell LINUX ENTERPRISE SERVER STARTER SYSTEM Manuale utente

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 2.0 -... Manuale utente

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 1 Manuale utente

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... Manuale utente

Novell

Novell GROUPWISE 7 - DOMAINS Manuale utente

Novell

Novell GROUPWISE 7 - 04-2007 Manuale utente

Novell

Novell EVOLUTION 2.6 Manuale utente

Novell

Novell GROUPWISE 8 - LIBRARIES AND DOCUMENTS Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Guida rapida

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manuale utente

Novell

Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio