HP NetStorage 6000, Руководство пользователя

Страница: 101 / 192

Securing Data
HP NetStorage 6000 Security in an NT-only Environment
8-6
User-Level Security
User-Level Security offers superior flexibility and ease of use on networks
with a significant number of users and/or resources. In this mode, each user
provides their logon account credentials to gain access to a computer or
network rather than providing passwords for network shares. Using this
method of security resources can be protected either at share, directory or
file level. Each resource may be protected on a user by user basis that
allows almost infinite permutations of access restrictions of users and
groups of users. User-Level Security is the default security mode of
Windows NT systems.
The user accounts may be either local machine accounts for access to a
single computer, or they may be accounts that apply to all computers
attached to the network. If a computer is attached to a network, then local
machine accounts are of little value, since the user of that account may only
access resources on that computer, and not any other computer on the
network. On the other hand, network-wide accounts allow users to access
resources on other computers on the network. In addition, these accounts
allow the user to logon to any computer on the network.
On NT networks, the network wide user accounts are managed through NT
domains.
Under User-Level security, each computer on the network is responsible
for authenticating users before the user is allowed to access the resources
on that computer. Once a user is authenticated on a computer, a session is
established with the user. The user does not need to be authenticated again
during that session. This not only applies to users accessing machines
directly (interactive logon), but also to users accessing resources on remote
servers (remote, or network logon).
Interactive logon is a very common experience for most users. Every time
a Windows NT computer boots, a user must logon to the system before
gaining access to any resource. The user is prompted to press Ctrl-Alt-Del
and then enter a name, password and NT Domain name at the console of
the local computer. Once the user is authenticated with these credentials,
the user is allowed access to the resources of the computer.
Remote logon is not as obvious to most users. When a user attempts to
access files on a remote computer (such as through Network
Neighborhood, or by mapping a network drive to a drive letter), the remote
computer must first authenticate the user before allowing access, even
though the user has already logged onto the local system. Unlike the