Novell CLIENT FOR LINUX 2.0 SP1 - ADMINISTRATION, Руководство администратора

Страница: 40 / 89

40 Novell Client 2.0 SP1 for Linux Administration Guide
n
ov
do
cx (e
n)
11
Ju
ly 20
08
5.2 Known Security Threats
The following section provides a list of known security threats for the Novell Client for Linux, an
indication of how difficult it would be to exploit the threat, and what the consequences would be for
a customer.
Table 5-2
Known Security Threats
5.3 Security Characteristics
Š
Section 5.3.1, “Identification and Authentication,” on page 41
Š
Section 5.3.2, “Authorization and Access Control,” on page 41
Š
Section 5.3.3, “Roles,” on page 41
Š
Section 5.3.4, “Security Auditing,” on page 41
Passwords, keys, and any other
authentication materials are stored
encrypted Yes Passwords and other authentication materials
in temporary storage are encrypted to prevent
in-memory scanners.
Security is on by default Yes There are no configuration options to enable
or disable with the exception of packet
signing. Packet signing is enabled by default.
FIPS 140-2 compliant No This product currently uses the ATB
(authentication toolbox) instead of the Novell
NICI product. Therefore, this product is not
FIPS 140-2 compliant because ATB itself is
not FIPS-compliant.
Description Consequence Likelihood Difficulty
Repetitive password cracking
attempts Intruder detection lockout Low Hard
“Stale” passwords Password expiration, grace login
enforcement High Hard
Attempted access out-of-hours or
from unauthorized locations Date/Time and Location restrictions at login Medium Easy
Port scanners Unsuccessful pass of Nessus* scans;
possible port hijacking Medium Possible
Man-in-the-middle attacks NCP request sequencing, packet signing Low Hard
Wire frame examination and
manipulation Same protections as with other Novell
products utilizing NCP and RSA-based
authentication Low Hard
Memory scanning for sensitive
data All buffers containing sensitive data
(passwords) are short-term in nature and
are zeroed and/or freed immediately after
use. Low Hard
Feature Yes/No Details