User manual NOVELL EDIRECTORY 8.8 SP5 ADMINISTRATION

[. . . ] novdocx (en) 22 June 2009 AUTHORIZED DOCUMENTATION Administration Guide Novell® 8. 8 SP5 eDirectoryTM December 02, 2009 www. novell. com Novell eDirectory 8. 8 Administration Guide novdocx (en) 22 June 2009 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. [. . . ] 4 Click Server List, then click the Object Selector button 5 Select the server you want. 6 Repeat Step 4 through Step 5 for each server you want to add. . WAN Traffic Manager 293 novdocx (en) 22 June 2009 To apply a WAN policy to the LAN Area object, thereby applying the policy to all the servers in the group, see "Applying WAN Policies" on page 295. Adding Additional Information to a LAN Area Object You can use ConsoleOne® to add descriptive information to a LAN Area object. This feature is not available in Novell iMonitor. 1 In ConsoleOne, right-click a LAN Area object. 3 Add the Owner, Description, Location, Department, and Organization information you want. 4 Click Apply, then click OK. 13. 1. 2 WAN Traffic Policies A WAN traffic policy is a set of rules that control the generation of eDirectory traffic. These rules are created as text and are stored as an eDirectory property value on the Server object, the LAN Area object, or both. The policy is interpreted according to a simple processing language. You can apply policies to individual servers or you can create LAN Area objects and assign several servers to one of these objects. Any policy that is applied to the LAN Area object is automatically applied to all servers that are assigned to the object. WAN Traffic Manager comes with several predefined policy groups. You can use these policies as they are, modify them to meet your needs, or write new policies. "Applying WAN Policies" on page 295 "Modifying WAN Policies" on page 295 "Renaming an Existing Policy" on page 296 "Creating New WAN Policies" on page 297 Predefined Policy Groups The following table lists groups of predefined policies with similar functions: Policy Group Description 1-3am. wmg 7am-6pm. wmg costlt20. wmg ipx. wmg ndsttyps. wmg onospoof. wmg opnspoof. wmg Limits the time traffic is sent to between 1 a. m. Limits the time traffic is sent to between 7 a. m. Allows only traffic that has a cost factor below 20 to be sent. Provides sample policies for various eDirectory traffic types. Allows only existing WAN connections to be used. Allows only existing WAN connections to be used but assumes that a connection that hasn't been used for 15 minutes is being spoofed and should not be used. 294 Novell eDirectory 8. 8 Administration Guide novdocx (en) 22 June 2009 Policy Group Description samearea. wmg tcpip. wmg timecost. wmg Allows traffic only in the same network area. but allows servers in the same location to talk continuously. For detailed information on the predefined policy groups and their individual policies, see Section 13. 2, "WAN Traffic Manager Policy Groups, " on page 300. Applying WAN Policies You can apply WAN policies to an individual server or to a LAN Area object. [. . . ] You can specify the server name in iManager. IMPORTANT: The user needs to access the LDAP server using the DNS name instead of the IP address of the server. This is because the conversion of the IP address to the DNS name is not secure. F. 2 Nessus Scan Results The following vulnerabilities were reported by Nessus port scan: LDAP servers that are not properly configured allow users to connect to the server and query for information Explanation: Null Bind is enabled on eDirectory LDAP server by default, but allows it to be disabled on the server. To enhance the security of the OES server, disable the NULL bind on the LDAP server port 389. [. . . ]