Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Implementation Manual, Page: 266 / 288

266 OES 2 SP2: Planning and Implementation Guide
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
Do Not Manually Configure Proxy Users
Best practices for most OES installation scenarios dictate that proxy users be created in eDirectory
prior to installing OES. For more information, see
“Limiting the Number of Proxy Users in Your
Tree” on page 267 .
After creation, proxy users should be configured for OES service use only by the YaST based install,
not manually.
The information in these sections only answers security questions and provides general information.
It is not intended to be used for the manual configuration of proxy users.
Avoid Assigning an Admin User As a Proxy User
We recommend using special-purpose proxy user accounts rather than specifying admin users as
proxy users.
Although specifying an admin user as the proxy user appears to be an easy way of setting up OES
services (and is the install default in some cases), there are potential problems. Mixing actual users
with system-level functionality always creates some risk.
The following is a real-life example of risks that can occur when admin users are assigned as proxy
users:
Novell Support received a call from an administrator who was getting locked out due to intruder
detection after changing the administrator password. The lockout happened several times each day
and seemed to be coming from the OES 2 servers. The support technician checked LUM and all of
the services he could think of, and didn’t see the admin credentials anywhere.
Samba (Novell) server_name -
SambaProxy
By default, the Samba proxy user is created in the
container specified as the Base Context for Samba
Users and is named
servername -sambaProxyUser.
You specify the password for this user when you
configure Novell Samba.
You can specify another eDirectory user as the Samba
proxy user. If you do, be aware of the following:
Š
If you specify a user that doesn’t already exist in
eDirectory, the user account is created and
granted the necessary rights. You must also
specify a password for the new user.
Š
If you specify an existing eDirectory user, it is
assumed that you have already created the user
account with the necessary rights and no
modifications are made to the existing user.
Š
If you specify an existing eDirectory user but enter
a new password, you are prompted to change the
password for that user.
Associated Service Default Proxy User Name Creation Information