Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Руководство по внедрению, Страница: 267 / 288

System User and Group Management in OES 2 SP2 267
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
Further investigation revealed that the administrator credentials had been used to install OES 2 on
multiple servers, and by default the credentials were therefore also used as the proxy user credentials
for some of the OES services. Consequently, the credentials were stored in CASA for use when the
OES services came up.
Because the Admin password had changed, the CASA credentials had expired and service
authentication requests were failing, resulting in the intruder detection lockout.
I.3.2 Proxy User Impacts on User Connection Licenses
From a licensing standpoint, each proxy user counts as a user on the OES network and consumes
one user connection license.
It is not unreasonable to expect that the OES servers you install could average five to six proxy users
a piece, meaning that an organization that has three to five OES servers installed with the default
settings, can expect that 15 to 30 of its user connection licenses might be taken by proxy users.
For large organizations with hundreds of servers, the user connections consumed by default
installations would be substantial. Therefore, large organizations are especially interested in
methods for limiting the number of proxy users on their network.
I.3.3 Limiting the Number of Proxy Users in Your Tree
Table I-6 outlines various options for limiting the number of proxy users in your tree and
summarizes the licensing, security, and manageability considerations of each approach.
Table I-6
Options for Limiting the Number of Proxy Users
Approach Licensing Impact Security Considerations Manageability Considerations
Per Service per
Server (default) One for each
service on each
server For AFP, CIFS, iFolder 3, NSS,
and Samba this is the most
secure option. Passwords for
these are system-generated
and not known by anyone.
For LUM there is no option to
have a system-generated
password.
For DNS, DHCP, and
NetStorage, the install admin’s
credentials are used by default.
This has separate security
implications as outlined in
“Avoid Assigning an Admin
User As a Proxy User” on
page 266
.
This approach requires no proxy
user planning.
Services are installed at the same
time as the OES server.
This is a good option for small
organizations or installations
where only a few services are
used.
This is not a good option if
security policies dictate that all
passwords must be reset
periodically.