Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE 12-2010, Implementation Manual

Page: 275 / 296

System User and Group Management in OES 2 SP3 275
Table I-6 Options for Limiting the Number of Proxy Users
Approach Security Considerations Manageability Considerations
Per Service per
Server (default) For CIFS, iFolder 3, NSS,
and Samba this is the most
secure option. Passwords
for these are system-
generated and not known by
anyone.
For LUM there is no option
to have a system-generated
password.
For DNS, DHCP, and
NetStorage, the install
admin’s credentials are used
by default. This has separate
security implications as
outlined in
“Avoid Assigning
an Admin User As a Proxy
User” on page 274
.
This approach requires no proxy user planning.
Services are installed at the same time as the OES
server.
This is a good option for small organizations or
installations where only a few services are used.
This is not a good option if security policies dictate that
all passwords must be reset periodically.
Per Server This confines any security
vulnerabilities to individual
servers and is the scenario
for which the Common Proxy
User was developed. This requires that a proxy user for the server is created
before the server is installed.
If the Common Proxy User is not leveraged, then for the
first server in the tree, eDirectory and iManager must be
installed with the server. After the server installation
finishes, a proxy user can be created. And finally the
services can be installed and configured to use the
proxy user for the server.
This approach is useful when each OES server is
managed by a separate administrator, or for enterprises
where branch users access a server in the branch
office.
Knowing the proxy user password is not required unless
additional services will be installed or password policies
require periodic changing, in which cases the install
admin must know the proxy user’s password.
Per Partition This confines any security
vulnerabilities to individual
partitions. This is useful when users are co-located with the OES
servers in a single partition, and cross-partition access
of users to services is rare.
This is a good approach for organizations where
eDirectory administration is done at a partition level.
This requires that a proxy user for the first server in the
partition is created before services are installed in the
partition.
The install admin must know the proxy user’s password.