Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Service manual

Novell
www.novell.com
novdocx (ENU) 01 February 2006
Novell iFolder 3.x Security Administrator Guide
iFolder®
3.x
August 15, 2006
SECURITY ADMINISTRATOR GUIDE

novdocx (ENU) 01 February 2006
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
Please refer to www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no
responsibility for your failure to obtain any necessary export approvals.
Copyright © 2005-2006 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed at http://www.novell.com/company/legal/patents/ and one or more additional patents or pending patent
applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and to get
updates, see www.novell.com/documentation.

novdocx (ENU) 01 February 2006
Novell Trademarks
For a list of Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/
legal/trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

novdocx (ENU) 01 February 2006

5
Contents
novdocx (ENU) 01 February 2006
About This Guide 7
1 Security Best Practices Overview 9
1.1 Security Recommendations for iFolder 3.x. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Security Recommendations for OES Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2 Security Best Practices for Novell iFolder 3.x11
2.1 Using SSL for Server - LDAP Server Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Using SSL for Enterprise Server - iManager Communications . . . . . . . . . . . . . . . . . . . . . . . . 12
2.3 Using SSL for Enterprise Server - Client Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.4 Using SSL for Enterprise Server - Web Access Server Communications . . . . . . . . . . . . . . . . 12
2.5 Using SSL for Web Access Server - Users’ Web Browser Communications . . . . . . . . . . . . . 12
2.6 Disabling SSL 2.0 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.7 Configuring a Cipher Suite to Use for SSL/TLS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.8 Installing Trusted Roots and Certifications on the iFolder server . . . . . . . . . . . . . . . . . . . . . . 13
2.9 Installing Server Certificates from a Known Certificate Authority. . . . . . . . . . . . . . . . . . . . . . . 13
2.10 Using a Shared Certificate in iFolder Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.11 Ensuring Privilege Separation for the iFolder Proxy User . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.12 Securing the iFolder Proxy User Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.13 Using Synchronize Now to Remove Users Effective Immediately. . . . . . . . . . . . . . . . . . . . . . 15
2.14 Controlling Access to the iFolder Data Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.15 Controlling Access to the iFolder Server Configuration Files. . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.16 Controlling Access to and Backing Up the iFolder Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . 15
2.17 Storing iFolder 3.xData Nonencrypted on the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.18 Preventing the Propagation of Viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.19 Backing Up the iFolder Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3 Security Best Practices for the iFolder Client 19
3.1 Configuring Client-Side Firewalls for iFolder Communications . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2 Configuring Client-Side Virus Scanners for iFolder Communications . . . . . . . . . . . . . . . . . . . 19
3.3 Configuring a Web Browser to Use SSL 3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4 Other Security Best Practices 21
4.1 Controlling Physical Access to the iFolder Servers and Resources . . . . . . . . . . . . . . . . . . . . 21
4.2 Securing Access to the Servers with a Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.3 Securing Communications with a VPN If SSL Is Disabled. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.4 Securing Wireless LAN Connections If SSL Is Disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.5 Creating Strong Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
A Documentation Updates 23
A.1 August 15, 2006. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
A.1.1 Security Best Practices for iFolder 3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
A.2 November 1, 2005 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

6Novell iFolder 3.x Security Administrator Guide
novdocx (ENU) 01 February 2006

novdocx (ENU) 01 February 2006
7
About This Guide
This guide provides specific instructions on how to install, configure, and maintain Novell®
iFolder®3.xand the iFolderTM client for iFolder 3.xin the most secure way possible.
•Chapter 1, “Security Best Practices Overview,” on page 9
•Chapter 2, “Security Best Practices for Novell iFolder 3.x,” on page 11
•Chapter 3, “Security Best Practices for the iFolder Client,” on page 19
•Chapter 4, “Other Security Best Practices,” on page 21
Audience
This guide is intended for network security administrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comment feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Novell iFolder 3.x Security Administrator Guide, visit the Novell
iFolder 3.x documentation Web site (http://www.novell.com/documentation/ifolder3/index.html).
For emerging issues with Novell iFolder 3.x and the iFolder client, see the Novell iFolder 3.x
Readme (http://www.novell.com/documentation/ifolder3/readme/data/readme.html).
Additional Documentation
For information, see the following:
•Novell iFolder 3.xdocumentation (http://www.novell.com/documentation/ifolder3/index.html)
•Novell Open Enterprise Server product site (http://www.novell.com/products/
openenterpriseserver)
•Novell Open Enterprise Server documentation (http://www.novell.com/documentation/oes/
index.html)
•Novell eDirectoryTM 8.7.3 documentation (http://www.novell.com/documentation/edir873/
treetitl.html)
•Novell iManager 2.5 documentation (http://www.novell.com/documentation/imanager25/
treetitl.html)
•Novell Linux Desktop 9 product site (http://www.novell.com/products/desktop/)
•Novell Linux Desktop 9 documentation (http://www.novell.com/documentation/nld/
treetitl.html)
•Novell Technical Support (http://www.novell.com/support/)

8Novell iFolder 3.x Security Administrator Guide
novdocx (ENU) 01 February 2006
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

Security Best Practices Overview
1
novdocx (ENU) 01 February 2006
9
1
Security Best Practices Overview
This section summarizes the recommended configurations and settings required to run Novell®
iFolder®3.xand the iFolderTM client in a secure mode.
•Section 1.1, “Security Recommendations for iFolder 3.x,” on page 9
•Section 1.2, “Security Recommendations for OES Linux,” on page 10
1.1 Security Recommendations for iFolder 3.x
The following table lists the iFolder server configuration settings that are security related or that
impact the security of iFolder resources.
Parameter Possible Values Default Value Recommended Value for
Best Security
Port for server to LDAP
server communications
iManager > Novell
iFolder 3 > System >
LDAP Settings > Server
Port
Port 636 (secure) or port
389 (insecure)
636, secure 636, secure
SSL for server to LDAP
server communications
iManager > Novell
iFolder 3 > System >
LDAP Settings > Port Is
Secure
Select Yes to enable
SSL; deselect Yes (No)
to disable SSL
Yes, SSL enabled Yes, SSL enabled
iFolder Proxy user
iManager > Novell
iFolder 3 > System >
LDAP Settings > iFolder
Proxy User
Autogenerated during
the iFolder enterprise
server configuration; can
be modified thereafter
Autogenerated Keep the autogenerated
iFolder Proxy username;
if you change it, make
sure the username is
different than the iFolder
Admin user, equivalent
iFolder Admin users,
and other system users;
and update the Proxy
User password.
iFolder Proxy user
password
iManager > Novell
iFolder 3 > System >
LDAP Settings > Proxy
User Password
User-specified Autogenerated during
initial configuration of the
iFolder server
User-specified, using
strong password
practices
Web browser to
iManager Server
communications
HTTPS and Novell
eDirectoryTM
authentication
HTTPS and eDirectory
authentication
HTTPS and eDirectory
authentication

10 Novell iFolder 3.x Security Administrator Guide
novdocx (ENU) 01 February 2006
1.2 Security Recommendations for OES Linux
For information about security issues in Novell Open Enterprise Server, see the following in the
Novell OES Planning and Implementation Guide (http://www.novell.com/documentation/oes/
implgde/data/front.html):
•“Authentication” (http://www.novell.com/documentation/oes/implgde/data/
authentication.html)
•“Security” (http://www.novell.com/documentation/oes/implgde/data/security.html)
iFolder Admin user User-specified User-specified
administrator user
Special iFolder Admin
user identity for
managing iFolder
services
Equivalent iFolder
Admin users
User-specified None Users with limited
administrator rights,
such as for a specific
iFolder server
Port for iManager to
server communications
iManager > Novell
iFolder 3 > (select any
task to go to the iFolder
Login page) > Port
Port 443 (secure) or port
80 (insecure)
443, secure 443, secure
SSL for iManager to
server communications
iManager > Novell
iFolder 3 > (select any
task to go to the iFolder
Login page) > Secure
Select Secure (secure)
to use SSL; deselect
Secure (insecure) to use
unencrypted
connections
Select Secure, SSL
enabled
Select Secure, SSL
enabled
Server to client
communications
/opt/novell/
ifolder3/web/
web.config file
SimiasRequireSSL (Yes/
No)
SimiasSSLPort
(443/80)
SimiasRequireSSL =
Yes
SimiasSSLPort = 443
SimiasRequireSSL =
Yes
SimiasSSLPort = 443
Parameter Possible Values Default Value Recommended Value for
Best Security