Netware 4.11 Administration
NetWare
Directory Services(NDS)
NDS is the cloud above the network. It is responsible for looking after the
network resources but not the file system. It is a complete database providing
access & management in a hierarchical form. In many ways like a domain. Users
login to NDS & resources reside in NDS as objects. Made up of three objects,
[Root], Container Objects, and Leaf Objects. Follows X.500 Standards.
[Root] Object
Top of NDS structure. The NDS tree can only have one root, from where all
other objects branch out. Similar to C:\
Container Objects
[Root] is a container objects but only one per tree is allowed, therefore
there are another three objects to build the tree.
Leaf
Objects
Leaf objects are the actual resources such as Users, File Servers, Volumes and
Directory Maps. There are 21 Leaf Objects.
NDS Naming Rules
All objects in NDS are accessed via their names. There are two types.
Fully
Distinguished Names (FDN)
The Objects complete NDS path from the objects to the [Root]. No trailing
periods are allowed. Leading periods are required. A name with a leading
period is always a FDN such as .CN=Andrew.OU=IT.O=MasonTech
Relative Distinguished Names (RDN)
Incomplete name based on current context. Lists path from objects TO current
context. No leading periods. Trailing periods are optional.
Context = .OU=IT.O=MasonTech so RDN would be CN=Andrew
Leading & Training Periods
A leading period indicates that the name is an FDN
Trailing periods are similar to the DOS "CD .." command but a single dot is
parent, double is grandparent. These are used when an RDN is specified & the
current context is not in the same container as the object.
eg.
When the Context = OU=Sales.O=Masontech to specify the Object Andrew you can
use the FDN .CN=Andrew.OU=IT.O=MasonTech or the RDN CN=Andrew.OU=IT..
This makes the context O=MasonTech and then the RDN + Context = FDN
Context
The context is like the NDS current directory. In DOS (With no path) if you
are in "C:\" you cannot run "WIN.EXE" due to the file been in the windows
directory (C:\Windows"). So in NDS it is not linked to the file system. If the
current context is [Root] and a user is in the O=MasonTech container then the
user cannot login without just be specifying his user name. He must supply
either a FDN or RDN. If you changed the context to O=MasonTech then the user
could login just specifying his short name ie Login Andrew.
The CX command is used to navigate & manage the context from a DOS prompt. The
CX command resides in SYS:PUBLIC and supports the following switches.
Typefull &
Typeless Naming
Typefull naming is when descriptors are used = .CN=Andrew.OU=IT.O=MasonTech
Typeless naming is when no descriptors are used = .Andrew.IT.MasonTech
Login
Login.exe is in SYS:LOGIN which usually maps to the first network drive
specified within net.cfg or windows 95 if client32. This drive is always
mapped as part of the client install even before the client has been
authenticated so it is important that care is taken as to this directories
contents.
When logging in you have to specify who you are and where you are from
relative to the current context. This can be done by entering a FDN or RDN in
either typefull or typless format.
File System
Disks are organized into Volumes and then into directories.
Volumes
The highest level in the NetWare file system. Volumes can be leaf objects in
NDS. They act as a bridge between NDS and the file system. The first volume is
always named SYS: an NDS leaf objects is also created caled %Servername_SYS.
Volumes are fixed units of hard disk storage. They can span physical disks.
NetWare can support 64 volumes and each volume can span 32 disks.
Represented as SERVER\VOLUME:DIRECTORY\(SUBDIRECTORY)\FILENAME.
System Created Directories
When the server is installed SYS: is created and nine directories within SYS: are also created.
Managing
The File System
There are various utilities available for managing the file system. Below are
the main utilities.
These can be used together so NDIR /FO /C OW=.Andrew.IT.MasonTech would display only files continuously that belong to me (.Andrew.IT.MasonTech)(note. this is a typeless FDN!!)
Drive Mapping
Map Commands
Security
NetWare 4 Security Model
Five layer security model
Layer 1 -
Login / Password Authentication
The first layer checks the user account against the NDS database and then the
password associated with the account. This is done from SYS:LOGIN.
Layer 2 - Login Restrictions
Once NDS has authenticated the logon credentials you can specify restriction
to the user as in NT, User Manager. These are time allowed to logon,
Workstation to logon from, Password expiration, Concurrent connections,
Account disabled, etc.. These are entered from the users object in NWAdmin.
Layer 3 - NDS Security
Once a user has been authenticated and any restrictions placed, NDS security
is the next layer.
The ACL (Access Control List) is a property of every NDS object to determine
who can access the object (Trustees) and what each trustee can do with the
object (Trustee Rights).
NDS supports two types of access rights, Object and Property.
Object
Rights
Control what a trustee can do with an object.
Remember the
phrase BCDRS for Object rights.
Property Rights
Once you are a trustee you must be given property rights to access properties
within the object.
Remember the
phrase SCRAWL for property rights.
Property rights can either be added in NWAdmin by "All Properties" or "Selected
Properties"
Default NDS Rights
Assigning
Trustee Rights (Object)
Trustee assignments are granted using NWAdmin or NETADMIN.
NDS rights can be assigned in one of three ways.
Trustee
Assignments
A Trustee is any object with rights to any other object. Trustees are tracked
through the ACL property. Every object has an ACL property. There are two ways
to assign trustee assignments.
In NWAdmin
right click on the Object and choose either "Rights To Other Objects" or
"Trustees Of This Object" and select the object from the NDS Tree.
Inheritance
A side effect of trustee assignments.
Trustees inherit the assignments for all containers and objects underneath the
specified object. There are two ways to stop this.
Security
Equivalence
Users Ancestral Inheritance, organization Role, Groups and Directory Maps to
group people together to add the rights on the group and not the user. Same as
group membership in NT.
Effective Rights
Effective Rights = Trustee Assignments - IRF + (Public) + Security Equivalence.
NDS Administration
You can administer NDS in two ways
Central
Administration
Central administration is where you only have one admin user with S rights to
the tree. This is default.
Distributed Administration
Distributed Administration allows you to designate users with supervisor rights
to containers of the tree.
Layer 4 -
File System Access Rights
NDS is above the server & file system is within the server on the same way as
share level and file level security operate in NT.
NDS and file system rights are similar and are assigned in the same 3 ways,
Trustee Assignments, Inheritance, and Security Equivalence.
However there are a few differences.
File System
Access Rights
There are 8 file system access rights.
Remember the
phrase WoRMFACES for File System Access Rights.
Default Rights
Layer 5 -
File/Directory Attributes
Like DOS attributes. Can be modified using the FLAG command line utility or
NETADMIN / NWAdmin.
Split into
Workstation Configuration Client 32 for Windows 95
32 bit protected mode NetWare client for 2.2, 3.1x, and 4.x. Integrates with
Windows Explorer and Network Neighborhood.
Load Order
and Files
Client32 initializes by loading the following files in the following order.
These files
are stored in the C:\NOVELL\CLIENT32 directory.
Installation
Installed using the Setup.EXE command from the appropriate directory.
Differences with 95&3.1x is NIOS.VXD and NIOS.EXE. Also 95 uses the registry
whereas 3.1x uses the NET.CFG file.
MSBATCH automatically upgrades Windows 3.1x to Windows 95 and installs Client32.
Client 32 for DOS / Windows 3.1x
Works in a similar way to the 4.1 client. Integrates into File Manager. During
installation client files are put into C:\NOVELL\CLIENT32.
Load Order and Files
Client32 initializes by loading the following files in the following order.
These files
are stored in the C:\NOVELL\CLIENT32 directory.
Installation
Installed using the INSTALL.EXE command from the appropriate directory. This
modifies the AUTOEXEC.BAT and CONFIG.SYS and creates NET.CFG which should be
checked after the install.
Login Scripts
Four types of login scripts in load order.
Container
login scripts cannot be inherited. They only apply to users in that specific
container.
Login Script Commands
There are a specific set of commands that will run in Login Scripts, such as
Write, Map, Fire Phasers. Variables can also be used such as %Login_name.
Menu System
A set of DOS like commands to display a simple Bar menu that runs commands.
Split into
Menu
Execution
Use a text editor to create a file with a .SRC extension. Use MENUMAKE.EXE to
compile the menu (.SRC) to a .DAT extension. The menu is executed from NMENU.BAT
which is in SYS:PUBLIC.
Read & File Scan are required to the .DAT files
MENU.SRC-------------->MENU.DAT------------>MENU
E-Mail
Integrated platform called MHS (Message Handling Service)
Stores & Forwards
3 Key Components
Install by
using INSTALL.NLM on the server and select "Product Options"
MHS is started by typing LOAD MHS this should be placed in the AUTOEXEC.NCF to
automatically load on Server boot.
Server Management
Server Management consists of three components
1 - Server Protection
2 - Console
Commands
These are internal system tools similar to DOS internal commands. Built into
SERVER.EXE.
3 - NetWare
Loadable Modules
NetWare loadable modules are applications which attach to the core OS and
provide added functionality. Similar to Services under NT.
Storage Management Services(SMS)
Built in Novell Backup
Three main components:
To backup the host server SBackup must be installed as well as TSA410 and TSANDS. The backup procedure uses Full, Incremental and Differential backup methods as in NTBackup.
Remote Management
The console can be remotely administered. LOAD REMOTE on the server then LOAD
RSPX or RS232 to enable the communications. REMOTE requires a password. This has
to be entered in clear text into AUTOEXEC.NCF. Consider using LDREMOTE instead,
which encrypts the password.
On the client you must use RCONSOLE.EXE from SYS:SYSTEM. You must specify a
connection type (SPX or RS232) and then the application will scan for servers
running REMOTE.NLM and the selected communication method. You must then enter
the REMOTE password. Control is then duplicated to the Server Console and any
server command can be run as if you were sat at the server console.
Printing
Printing on Novell consists of four processes.
1 -
Capturing
Capturing is Novell’s way of redirecting a local port to a print server. It is
the same as NET USE LPT1: in WindowsNT. NetWare uses MAP for drives and CAPTURE
for printers. In DOS this is done via the CAPTURE commands whereas windows uses
the NWUSER program.
2 - The
Print Queue
The capture command redirects output to a queue. The queue is an NDS object. You
must specify a name on a volume for the queue. A "QUEUES" directory is created
on the volume to store the queue information. Operators and Users can be added
to the Queue. The queue stores the print jobs in order and the info appertaining
to the job such as the creator, number of copies etc..
No Assignments are added to a Print Queue
3 - The Print Server
The print server polls the queue and sends its info to the printer. The print
server must be activated by typing LOAD PSERVER on the console then choosing the
print server to load. Operators and users can be added.
You add printer assignments to a Print Server
4 - The Printer
You set up a printer and tell it where it is in relation to the print server.
The printer actually sits of the print server on a local port or anywhere on the
network if the printer is equipped with a third party interface such as Jet
Direct by HP. Notification can be set but no users or operators are assigned as
this is handled by the print queue or print server. You add queue assignments
to a Printer
Printing Set-up
To set up printing:
Print Forms
These are custom page layouts that can be created with PRINTDEF and specified
using PRINTCON or NWADMIN??
Printing Management
There are 5 key printing management applications these are: