NetOp Security Management
The purpose of the optional NetOp Security
Management is to control and administrate
NetOp security in a centralized and
fault-tolerant way. The concept consists of
five components: The NetOp Security Server,
the NetOp Security Manager, an ODBC database,
the NetOp Guest and the NetOp Host.
NetOp Security Server
The NetOp Security Server is a special Host
module that can answer queries from other
NetOp modules about session permissions and
rights across a network connection by
forwarding the queries to the ODBC database.
The program must have access to the ODBC
database containing security relations between
the Guests and the Hosts. It is also capable
of receiving NetOp log events and saving them
in the ODBC database. For redundancy and load
balancing, it is preferable to use more than
one NetOp Security Server.
It is possible to use the NetOp Security
Server in mixed environments with NetOp
modules not supporting NetOp Security
Management. In addition you can enable
backwards compatibility by letting the NetOp
Security Server work as an older NetOp Access
Server. This will allow it to handle all OS/2
Hosts and Windows Hosts using the Access
Server authentication scheme from previous
releases.
NetOp Security
Manager
The NetOp Security Manager configures how the
NetOp Security Servers operate in your
network. It is a client program that can edit
information in a supported
ODBC compatible database.
The database is input to the NetOp Security
Servers, and it is from this information the
Security Servers allow or deny NetOp Guests
access to NetOp Hosts. The NetOp Security
Manager must be run on a Windows NT, 2000, XP
or 2003 platform for full functionality.
ODBC Database
The ODBC database can be any database system
capable of handling communication through the
ODBC interface. By using a standard interface
like ODBC, you can use your own database
system, which might contain fault-tolerance
and other features for making the system
available 24 hours a day. If you do not have
any database system available, the NetOp
Security Manager can create a local database
for you based on the Microsoft Jet Engine.
Once you have the data source ready, the NetOp
Security Manager will construct customized
default tables for you to start working
immediately.
NetOp Guest
The NetOp Guests can initiate sessions with
NetOp Hosts. When a NetOp Guest program tries
to contact a NetOp Host program, the Guest
identifies itself with a name and a password,
which usually are a Windows Domain user name
and a password. After the Windows Domain has
validated user name and password, the Host
program sends the user name to the Security
Server together with information about the
Host computer. The Security Server queries all
relevant Role Assignment records in the ODBC
database (a Role Assignment is a database
record with a Guest field, a Host field and a
Role field). It then returns to the Host
information about what the Guest is allowed to
do. On Windows NT/Windows 2000, the rights
granted could be affected by the Windows
Domain user logged in on the host computer.
NetOp Host
The NetOp Host module can optionally be
configured to use NetOp Security Management
instead of the other available security
methods. It uses an authentication key pair to
secure the relationship with a specific NetOp
Security Server group. Every time a NetOp
Guest tries to gain access, the Host will
perform a query to the NetOp Security Server
to verify the session permissions and rights.
A NetOp Host can from a security point of view
be handled as a computer and a person. You can
specify an individual workstation as a host,
but this requires that you explicitly enter
roles for each and every workstation into the
database. Instead, you can group computers
into domains (or workgroups) that already
exist on your network. If you connect to a
computer and no one is logged in on that
computer, you obtain the accumulated rights
you have against the workstation and its
domain. When you add a new computer to a
domain, it will automatically be subject to
the same NetOp security procedures as all
other PCs in that domain or workgroup.
If someone is logged on to the computer you
connect to, you obtain the accumulated rights
you have against the logged-in NT user and all
the NT user groups, which he/she is a member
of. If nobody is logged in, the workstation
identification counts. If that someone is not
a globally defined user, but one that is only
defined locally, he/she will be ignored and
rights against the workstation will be
granted. Global security is defined on global
users only. From the Policy List view, you can
set a Host mode, where you always ignore a
logged-in user, and always grant rights based
on the workstation name.
Related NetOp products
NetOp Security Server is compatible with NetOp
Remote Control 7.0 and later. Backwards
compability is available for NetOp Remote
Control 6.x, NetOp for OS/2 6.x and 5.x, NetOp
for Windows 5.x running ‘Use NetOp Access
Server on host side authentication.
Technical
requirements
Computer
Intel 80486 processor or higher, or 100%
compatible.
Memory
Guest: OS requirement plus additional 16 MB
(32 MB or more recommended). Other modules: OS
requirement plus additional 12 MB (16 MB
recommended).
Platform
Windows Server 2003 Standard, Enterprise and
Web Edition.
Windows XP Professional, Tablet PC Edition,
Home Edition.
Windows 2000
Server, Advanced Server.
Windows 2000 Terminal Services*.
Windows 2000 Professional.
Windows NT 4.0 Terminal Server*.
Windows NT Server 4.0.
Windows NT Workstation 4.0.
Windows ME, 98, 95.
Video
Any 100% VGA compatible graphics adapter
supported by Windows.
Disk space
Each module requires less than 15 MB.
Communications
TCP/IP: Winsock 1.1 or compatible.
IPX: Microsoft NWLink or Novell IPX.
NetBIOS: IBM, Microsoft, Novell or compatible
NetBIOS.
Windows modem: TAPI version 1.4 or compatible.
Digital modem: Modem supporting the AT command
set.
Analog modem: Modem supporting the AT command
set.
ISDN/CAPI: ISDN adapter with a CAPI driver.
Infrared: Windows Server 2003, XP, 2000 or 98
with IrDA enabled.
Multimedia
Sound adapter with recording mixer support.
* Only supported on the server console.
