Novell IFOLDER 3.6 - SECURITY ADMINISTRATION User manual

Novell®
www.novell.com
novdocx (en) 11 July 2008
AUTHORIZED DOCUMENTATION
Novell iFolder 3.6 Security Administration Guide
iFolder ®
3.6
December 2007
Security Administration Guide

novdocx (en) 11 July 2008
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please
refer to the Novell International Trade Services Web Page (http://www.novell.com/info/exports/) for more
information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary
export approvals.
Copyright © 2004-2007 Novell, Inc. All rights reserved. Permission is granted to copy, distribute, and/or modify this
document under the terms of the GNU Free Documentation License (GFDL), Version 1.2 or any later version,
published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the GFDL can be found at the GNU Free Documentation Licence (http://www.fsf.org/licenses/
fdl.html).
THIS DOCUMENT AND MODIFIED VERSIONS OF THIS DOCUMENT ARE PROVIDED UNDER THE
TERMS OF THE GNU FREE DOCUMENTATION LICENSE WITH THE FURTHER UNDERSTANDING THAT:
1. THE DOCUMENT IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE DOCUMENT
OR MODIFIED VERSION OF THE DOCUMENT IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A
PARTICULAR PURPOSE, OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY, ACCURACY,
AND PERFORMANCE OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS WITH
YOU. SHOULD ANY DOCUMENT OR MODIFIED VERSION PROVE DEFECTIVE IN ANY RESPECT, YOU
(NOT THE INITIAL WRITER, AUTHOR OR ANY CONTRIBUTOR) ASSUME THE COST OF ANY
NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES
AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED VERSION OF THE
DOCUMENT IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER; AND
2. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING
NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE AUTHOR, INITIAL WRITER, ANY
CONTRIBUTOR, OR ANY DISTRIBUTOR OF THE DOCUMENT OR MODIFIED VERSION OF THE
DOCUMENT, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER
INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE,
COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR LOSSES ARISING
OUT OF OR RELATING TO USE OF THE DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT,
EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES.
Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web Page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.

novdocx (en) 11 July 2008
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and to get
updates, see the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 July 2008
Novell Trademarks
For a list of Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/
legal/trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

Contents 5
Contents
novdocx (en) 11 July 2008
About This Guide 7
1 Security Best Practices Overview 9
1.1 Security Recommendations for iFolder 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Security Recommendations for OES Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2 Security Best Practices for Novell iFolder 3.6 11
2.1 Secure Communication with the LDAP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1.1 Using SSL for Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1.2 LDAP Server Certificate via YaST Install. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2 Communication between the Web Admin Server and the Web Admin Browser . . . . . . . . . . . 12
2.3 Enterprise Client/Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.4 Web Access Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5 Disabling the SSL 2.0 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.6 Configuring a Cipher Suite to Use for SSL/TLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.7 Installing Trusted Roots and Certifications on the iFolder Server . . . . . . . . . . . . . . . . . . . . . . 13
2.8 Installing Server Certificates from a Known Certificate Authority . . . . . . . . . . . . . . . . . . . . . . . 13
2.9 Using a Shared Certificate in iFolder Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.10 Ensuring Privilege Separation for the iFolder Proxy User . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.11 Using Synchronize Now to Remove Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.12 Controlling Access to the iFolder Data Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.13 Controlling Access to the iFolder Server Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.14 Controlling Access to And Backing Up the iFolder Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . 15
2.15 Storing iFolder 3.6 Data Encrypted on the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.16 Preventing the Propagation of Viruses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.17 Backing Up the iFolder Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.18 Loading the Recovery Agent Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3 Security Best Practices for the iFolder Client 17
3.1 Configuring Client-Side Firewalls for iFolder Communications . . . . . . . . . . . . . . . . . . . . . . . . 17
3.2 Configuring Client-Side Virus Scanners for iFolder Communications . . . . . . . . . . . . . . . . . . . 17
3.3 Configuring a Web Browser to Use SSL 3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.4 Creating an Encrypted iFolder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.5 Using the Recovery Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.6 Transferring the Encryption Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4 Other Security Best Practices 19
4.1 Controlling Physical Access to the iFolder Servers and Resources. . . . . . . . . . . . . . . . . . . . . 19
4.2 Securing Access to the Servers with a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.3 Securing Communications with a VPN If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.4 Securing Wireless LAN Connections If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4.5 Creating Strong Password And Passphrase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

6Novell iFolder 3.6 Security Administration Guide
novdocx (en) 11 July 2008
A Documentation Updates 21
A.1 December 2007 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
A.2 October 2007 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
A.3 August 15, 2006 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
A.4 November 1, 2005 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

About This Guide 7
novdocx (en) 11 July 2008
About This Guide
This guide provides specific instructions on how to install, configure, and maintain Novell®
iFolder®3.6 and the iFolderTM client for iFolder 3.6 in the most secure way possible.
Chapter 1, “Security Best Practices Overview,” on page 9
Chapter 2, “Security Best Practices for Novell iFolder 3.6,” on page 11
Chapter 3, “Security Best Practices for the iFolder Client,” on page 17
Chapter 4, “Other Security Best Practices,” on page 19
Audience
This guide is intended for network security administrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comment feature at the bottom of each page of the
online documentation, or go to Novell Documentation Feedback (http://www.novell.com/
documentation/feedback.html) and enter your comments there.
Documentation Updates
For the most recent version of the Novell iFolder 3.x Security Administrator Guide, visit the Novell
iFolder 3.x documentation Web site (http://www.novell.com/documentation/ifolder3/index.html).
For emerging issues with Novell iFolder 3.6 and the iFolder client, see the Novell iFolder 3.6
Readme (http://www.novell.com/documentation/beta/ifolder3).
Additional Documentation
Novell iFolder 3.xdocumentation (http://www.novell.com/documentation/ifolder3/index.html)
Novell Open Enterprise Server product site (http://www.novell.com/products/
openenterpriseserver)
Novell Open Enterprise Server documentation (http://www.novell.com/documentation/oes/
index.html)
Novell eDirectoryTM 8.8 documentation (http://www.novell.com/documentation/edir88/
treetitl.html)
Novell iManager 2.7 documentation (http://www.novell.com/documentation/imanager27/
treetitl.html)
Novell Technical Support (http://www.novell.com/support/)
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.

8Novell iFolder 3.6 Security Administration Guide
novdocx (en) 11 July 2008
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

Security Best Practices Overview
1
9
novdocx (en) 11 July 2008
1
Security Best Practices Overview
This section summarizes the recommended configurations and settings required to run Novell®
iFolder®3.6 and the iFolderTM client in a secure mode.
Section 1.1, “Security Recommendations for iFolder 3.6,” on page 9
Section 1.2, “Security Recommendations for OES Linux,” on page 10
1.1 Security Recommendations for iFolder 3.6
The following table lists the iFolder server configuration settings that impact iFolder security.
Table 1-1 Security Recommendations
Parameter Possible Values Default Value Recommended Value for
Best Security
SSL for server to LDAP
server communications
Novell iManager >
iFolder 3.6 > Launch
iFolder Web Admin
Console > Servers >
Server Details > LDAP
SSL > Yes
Select Yes to enable
SSL; deselect Yes (No)
to disable SSL
Yes, SSL enabled Yes, SSL enabled
Web browser to
iManager Server
communications
HTTPS and Novell
eDirectoryTM
authentication
HTTPS and eDirectory
authentication
HTTPS and eDirectory
authentication
iFolder Admin user User-specified User-specified
administrator user
Special iFolder Admin
user identity for
managing iFolder
services
Equivalent iFolder
Admin users
User-specified None Users with limited
administrator rights,
such as for a specific
iFolder server
iFolder Proxy user
password
User-specified Auto generated during
initial configuration of the
iFolder server
User-specified, using
strong password
practices

10 Novell iFolder 3.6 Security Administration Guide
novdocx (en) 11 July 2008
1.2 Security Recommendations for OES Linux
For information about security issues in Novell Open Enterprise Server, see the following sections
in the Novell OES Planning and Implementation Guide (http://www.novell.com/documentation/oes/
implgde/data/front.html):
“Authentication” (http://www.novell.com/documentation/oes/implgde/data/
authentication.html)
“Security” (http://www.novell.com/documentation/oes/implgde/data/security.html)