Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Manuale di servizio

Novell

www.novell.com

novdocx (ENU) 01 February 2006

Novell iFolder 3.x Security Administrator Guide

iFolder®

3.x

August 15, 2006

SECURITY ADMINISTRATOR GUIDE

novdocx (ENU) 01 February 2006

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

Please refer to www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no

responsibility for your failure to obtain any necessary export approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed at http://www.novell.com/company/legal/patents/ and one or more additional patents or pending patent

applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the online documentation for this and other Novell products, and to get

updates, see www.novell.com/documentation.

novdocx (ENU) 01 February 2006

Novell Trademarks

For a list of Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/

legal/trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (ENU) 01 February 2006

Contents

novdocx (ENU) 01 February 2006

About This Guide 7

1 Security Best Practices Overview 9

1.1 Security Recommendations for iFolder 3.x. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2 Security Recommendations for OES Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

2 Security Best Practices for Novell iFolder 3.x11

2.1 Using SSL for Server - LDAP Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2 Using SSL for Enterprise Server - iManager Communications . . . . . . . . . . . . . . . . . . . . . . . . 12

2.3 Using SSL for Enterprise Server - Client Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.4 Using SSL for Enterprise Server - Web Access Server Communications . . . . . . . . . . . . . . . . 12

2.5 Using SSL for Web Access Server - Users’ Web Browser Communications . . . . . . . . . . . . . 12

2.6 Disabling SSL 2.0 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.7 Configuring a Cipher Suite to Use for SSL/TLS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.8 Installing Trusted Roots and Certifications on the iFolder server . . . . . . . . . . . . . . . . . . . . . . 13

2.9 Installing Server Certificates from a Known Certificate Authority. . . . . . . . . . . . . . . . . . . . . . . 13

2.10 Using a Shared Certificate in iFolder Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.11 Ensuring Privilege Separation for the iFolder Proxy User . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.12 Securing the iFolder Proxy User Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.13 Using Synchronize Now to Remove Users Effective Immediately. . . . . . . . . . . . . . . . . . . . . . 15

2.14 Controlling Access to the iFolder Data Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

2.15 Controlling Access to the iFolder Server Configuration Files. . . . . . . . . . . . . . . . . . . . . . . . . . 15

2.16 Controlling Access to and Backing Up the iFolder Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . 15

2.17 Storing iFolder 3.xData Nonencrypted on the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.18 Preventing the Propagation of Viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.19 Backing Up the iFolder Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3 Security Best Practices for the iFolder Client 19

3.1 Configuring Client-Side Firewalls for iFolder Communications . . . . . . . . . . . . . . . . . . . . . . . . 19

3.2 Configuring Client-Side Virus Scanners for iFolder Communications . . . . . . . . . . . . . . . . . . . 19

3.3 Configuring a Web Browser to Use SSL 3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4 Other Security Best Practices 21

4.1 Controlling Physical Access to the iFolder Servers and Resources . . . . . . . . . . . . . . . . . . . . 21

4.2 Securing Access to the Servers with a Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.3 Securing Communications with a VPN If SSL Is Disabled. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.4 Securing Wireless LAN Connections If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4.5 Creating Strong Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

A Documentation Updates 23

A.1 August 15, 2006. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

A.1.1 Security Best Practices for iFolder 3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

A.2 November 1, 2005 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

6Novell iFolder 3.x Security Administrator Guide

novdocx (ENU) 01 February 2006

About This Guide

This guide provides specific instructions on how to install, configure, and maintain Novell®

iFolder®3.xand the iFolderTM client for iFolder 3.xin the most secure way possible.

•Chapter 1, “Security Best Practices Overview,” on page 9

•Chapter 2, “Security Best Practices for Novell iFolder 3.x,” on page 11

•Chapter 3, “Security Best Practices for the iFolder Client,” on page 19

•Chapter 4, “Other Security Best Practices,” on page 21

Audience

This guide is intended for network security administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comment feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Novell iFolder 3.x Security Administrator Guide, visit the Novell

iFolder 3.x documentation Web site (http://www.novell.com/documentation/ifolder3/index.html).

For emerging issues with Novell iFolder 3.x and the iFolder client, see the Novell iFolder 3.x

Readme (http://www.novell.com/documentation/ifolder3/readme/data/readme.html).

Additional Documentation

For information, see the following:

•Novell iFolder 3.xdocumentation (http://www.novell.com/documentation/ifolder3/index.html)

•Novell Open Enterprise Server product site (http://www.novell.com/products/

openenterpriseserver)

•Novell Open Enterprise Server documentation (http://www.novell.com/documentation/oes/

index.html)

•Novell eDirectoryTM 8.7.3 documentation (http://www.novell.com/documentation/edir873/

treetitl.html)

•Novell iManager 2.5 documentation (http://www.novell.com/documentation/imanager25/

treetitl.html)

•Novell Linux Desktop 9 product site (http://www.novell.com/products/desktop/)

•Novell Linux Desktop 9 documentation (http://www.novell.com/documentation/nld/

treetitl.html)

•Novell Technical Support (http://www.novell.com/support/)

8Novell iFolder 3.x Security Administrator Guide

novdocx (ENU) 01 February 2006

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

Security Best Practices Overview

novdocx (ENU) 01 February 2006

Security Best Practices Overview

This section summarizes the recommended configurations and settings required to run Novell®

iFolder®3.xand the iFolderTM client in a secure mode.

•Section 1.1, “Security Recommendations for iFolder 3.x,” on page 9

•Section 1.2, “Security Recommendations for OES Linux,” on page 10

1.1 Security Recommendations for iFolder 3.x

The following table lists the iFolder server configuration settings that are security related or that

impact the security of iFolder resources.

Parameter Possible Values Default Value Recommended Value for

Best Security

Port for server to LDAP

server communications

iManager > Novell

iFolder 3 > System >

LDAP Settings > Server

Port

Port 636 (secure) or port

389 (insecure)

636, secure 636, secure

SSL for server to LDAP

server communications

iManager > Novell

iFolder 3 > System >

LDAP Settings > Port Is

Secure

Select Yes to enable

SSL; deselect Yes (No)

to disable SSL

Yes, SSL enabled Yes, SSL enabled

iFolder Proxy user

iManager > Novell

iFolder 3 > System >

LDAP Settings > iFolder

Proxy User

Autogenerated during

the iFolder enterprise

server configuration; can

be modified thereafter

Autogenerated Keep the autogenerated

iFolder Proxy username;

if you change it, make

sure the username is

different than the iFolder

Admin user, equivalent

iFolder Admin users,

and other system users;

and update the Proxy

User password.

iFolder Proxy user

password

iManager > Novell

iFolder 3 > System >

LDAP Settings > Proxy

User Password

User-specified Autogenerated during

initial configuration of the

iFolder server

User-specified, using

strong password

practices

Web browser to

iManager Server

communications

HTTPS and Novell

eDirectoryTM

authentication

HTTPS and eDirectory

authentication

HTTPS and eDirectory

authentication

10 Novell iFolder 3.x Security Administrator Guide

novdocx (ENU) 01 February 2006

1.2 Security Recommendations for OES Linux

For information about security issues in Novell Open Enterprise Server, see the following in the

Novell OES Planning and Implementation Guide (http://www.novell.com/documentation/oes/

implgde/data/front.html):

•“Authentication” (http://www.novell.com/documentation/oes/implgde/data/

authentication.html)

•“Security” (http://www.novell.com/documentation/oes/implgde/data/security.html)

iFolder Admin user User-specified User-specified

administrator user

Special iFolder Admin

user identity for

managing iFolder

services

Equivalent iFolder

Admin users

User-specified None Users with limited

administrator rights,

such as for a specific

iFolder server

Port for iManager to

server communications

iManager > Novell

iFolder 3 > (select any

task to go to the iFolder

Port 443 (secure) or port

80 (insecure)

443, secure 443, secure

SSL for iManager to

server communications

iManager > Novell

iFolder 3 > (select any

task to go to the iFolder

Select Secure (secure)

to use SSL; deselect

Secure (insecure) to use

unencrypted

connections

Select Secure, SSL

enabled

Select Secure, SSL

enabled

Server to client

communications

/opt/novell/

ifolder3/web/

web.config file

SimiasRequireSSL (Yes/

No)

SimiasSSLPort

(443/80)

SimiasRequireSSL =

Yes

SimiasSSLPort = 443

SimiasRequireSSL =

Yes

SimiasSSLPort = 443

Parameter Possible Values Default Value Recommended Value for

Best Security

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Novell Software

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - OPENOFFICE Manuale utente

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 2.0 -... Manuale utente

Novell

Novell iFOLDER 3.6 - READ ME 05-2008 Manuale utente

Novell

Novell Account Management 2.1 Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - GNOME... Manuale utente

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Manuale di istruzioni

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Manuale utente

Novell

Novell CLIENT FOR LINUX 2.0 SP1 - ADMINISTRATION Manuale di istruzioni

Novell

Novell GROUPWISE 8 - DOMAINS Manuale utente

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 9.3 -... Manuale di istruzioni

Novell

Novell CLIENT FOR LINUX 1.1 Manuale di istruzioni

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 3 Manuale utente

Novell

Novell IFOLDER 3.8 - CROSS-PLATFORM Manuale utente

Novell

Novell GROUPWISE 8 - USERS Manuale utente

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Novell

Novell LINUX ENTERPRISE SERVER 11 - DEPLOYMENT Guida di riferimento rapido

Novell

Novell EDIRECTORY 8.8 SP2 Manuale utente

Novell

Novell LINUX ENTERPRISE SERVER 10 - ARCHITECTURE-SPECIFIC INFORMATION... Manuale

Novell

Novell ACCESS MANAGER 3.1 SP2 BETA 1 - SCENARIOS... Manuale utente

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 - INTEGRATION AND STREAMING GUIDE... Manuale utente

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 1 Manuale utente

Novell

Novell ZENWORKS 10 ASSET MANAGEMENT SP3 - MIGRATION GUIDE 10.3... Manuale utente

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Manuale di istruzioni

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio