Novell EDIRECTORY 8.8 SP3, Руководство администратора, Страница: 60 / 634

60 Novell eDirectory 8.8 Administration Guide
n
ov
do
cx (e
n)
11
Ju
ly 20
08
1.9 Access to Resources
eDirectory provides a basic level of network access security through default rights. You can provide
additional access control by completing the tasks outlined below.
Š
Assigning rights
Each time a user attempts to access a network resource, the system calculates the user’s
effective rights to that resource. To ensure that users have the appropriate effective rights to
resources, you can make explicit trustee assignments, grant security equivalences, and filter
inherited rights.
To simplify the assignment of rights, you can create Group and Organizational Role objects,
then assign users to the groups and roles.
Š Adding login security
Login security is not provided by default. You can set up several optional login security
measures, including login passwords, login location and time restrictions, limits on concurrent
login sessions, intruder detection, and login disabling.
Š
Setting up role-based administration
You can set up administrators for specific object properties and grant them rights to only those
properties. This allows you to create administrators with specific responsibilities that can be
inheritable to subordinates of any given container object. A role-based administrator can have
responsibilities over any specific properties, such as those that relate to employee information
or passwords.
See
Installing RBS (http://www.novell.com/documentation/imanager25/imanager_admin_25/
data/am757mw.html#bu1rlq9) in the Novell iManager 2.5 Administration Guide for instruction
on setting up Role-Based Services.
You can also define roles in terms of the specific tasks that administrators can perform in role-
based administration applications. See
Section 3.3, “Configuring Role-Based Services,” on
page 103 for more information.
1.10 eDirectory Rights
When you create a tree, the default rights assignments give your network generalized access and
security. Some of the default assignments are as follows:
Š
User Admin has the Supervisor right to the top of the tree, giving Admin complete control over
the entire directory. Admin also has the Supervisor right to the NetWare Server object, giving
complete control over any volumes on that server.
Š
[Public] has the Browse right to the top of the tree, giving all users the right to view any objects
in the tree.
Š
Objects created through an upgrade process such as a NetWare migration, printing upgrade, or
Windows user migration receive trustee assignments appropriate for most situations.