HP NetStorage 6000, User Manual

Page: 102 / 192

Securing Data
HP NetStorage 6000 Security in an NT-only Environment
8-7
interactive logon, remote logon usually occurs automatically, without user
interaction. The local computer offers the account name and password from
the interactive logon as credentials to logon to the remote computer.
The HP NetStorage 6000 fully supports the remote logon process. There is
no distinction between how the HP NetStorage 6000 authenticates users
and how a Windows NT 4.0 server authenticates users. However, since the
HP NetStorage 6000 does not offer a local console interface, interactive
logon is not supported. In addition, user and group accounts local to the HP
NetStorage 6000 are not supported. In User-Level security, access is only
allowed to users in a Windows NT domain environment.
The HP NetStorage 6000 currently does not support authentication through
Windows 2000 domain controllers running in native mode. The HP
NetStorage 6000 also does not participate in the Windows 2000 Active
Directory Services (ADS). However, the HP NetStorage 6000 can
authenticate through a Windows 2000 domain controller operating in
mixed mode. This means that the domain controller is configured to
authenticate Windows NT 4.0 style requests in addition to native Windows
2000 style requests.
Security Descriptors
Windows NT, in conjunction with the NT File System (NTFS), is designed
to support restricted access to any object (i.e. files or directories) on the File
System. Every file and directory stored on the system contains a small
amount of administrative information (often referred to as metadata),
which includes the security information associated with the object. This
information is known as the Security Descriptor, and contains the
following main attributes:
Attribute Description
Owner SID The owner’s security ID
Group SID The security ID of the primary group for the
object (used only by POSIX)
Discretionary Access
Control List (DACL) Specifies who has what access to an object
System Access Control
List (SACL) Controls the auditing messages the system
will generate. System ACLs are controlled by
the administrators.