Newsgroups: bit.listserv.novell
Date:         Sat, 26 Sep 1992 02:48:21 EDT
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Brett Warthen <BRETT@INFINITE.MHS.COMPUSERVE.COM>
Subject:      Security Risk...

Regarding the recent security risk to NetWare networks discussed on this
list (the Dutch one, not the KNOCK one revisited)...

I just wanted to let everyone know that Novell has released an NLM for
NetWare 3.11 to address the potential problem (nothing yet on other
versions of NetWare).  The filename is SECURE.ZIP and it is available in
Library 1 of NOVLIB on CompuServe and (hopefully) Novell's FTP mirror site
of NOVLIB.

Here is some of the information contained in the text files within this
ZIP:

======================== SECUREFX.DOC ================================

                     README FOR SECUREFX.NLM

This README file accompanies SECUREFX.NLM in SECUREFX.ZIP.  The
following files are included for this revision:

SECUREFX NLM      1960 09-25-92   1:54p
SECUREFX DOC      (this file)

Purpose:
SECUREFX.NLM is designed as an enhancement to the existing security features
in the NetWare v3.11 Operating System.

If a security violation is detected, SECUREFX.NLM will disable the station
connection of user who's rights are being usurped by the attempted break-in.
 The following error messages will be displayed at the console,
at all attached workstations, and written to the error log:
"Security breach against station <connection number> NEUTRALIZED."  In
addition, the message "Connection TERMINATED to prevent security compromise"
will be written to the error log and to the console output display.

If the user desires to be notified of an attempted security breach without
terminating any user connections, the command line parameter "-NK" should be
used.  Use of the -NK option detects and logs the security breach only.

SECUREFX.NLM is intended for all number-of-user versions of the NetWare
v3.11 Operating System.  SECUREFX.NLM is a dynamic patch which is loaded at
the file server console as a NetWare Loadable Module. SECUREFX.NLM requires
the latest version of PATCHMAN.NLM (v2.23) in order to load.

Unlike previous patches, the SERVER.EXE file is never modified by this
patch. SECUREFX.NLM patches the Operating System in memory, not on
the disk.  This means that SECUREFX.NLM must be loaded each time
before any "fixes" take effect. It is recommended that the command "LOAD
SECUREFX" be placed in the server's AUTOEXEC.NCF file to ensure that
the patch is always in effect when the server is initially brought up. In
the event that the -NK option is desired, the command "LOAD
SECUREFX -NK" should be placed in the AUTOEXEC.NCF.  This "NK" must be in
upper case.

Since it is an NLM, SECUREFX.NLM can be loaded and unloaded without
ever having to bring the server down. Once loaded, the Operating System
is patched and ready to go. Unloading SECUREFX will restore the
Operating System to its original "un-patched" state.

Like all NLM-type patches, SECUREFX.NLM requires the Patch Manager
(PATCHMAN.NLM) to be loaded before it can be loaded.  If PATCHMAN
is not already loaded, SECUREFX will attempt to locate PATCHMAN and
load it automatically if found. PATCHMAN only needs to be loaded once.
All other patches can load once PATCHMAN is loaded. PATCHMAN
cannot be unloaded until all patches that rely on it are first unloaded.
Typing "Patches" at the system command line once PATCHMAN is loaded
will display all patches currently loaded on the file server.

Installation:

To install SECUREFX.NLM, simply place the SECUREFX.NLM file in the
same directory as the other NLM files (SYS:SYSTEM or DOS partition), and
type "LOAD SECUREFX." (or LOAD SECUREFX -NK ) Once the patch has loaded,
all changes are in effect until SECUREFX is unloaded.  If an error message
appears, contact Novell Technical Support.

The changes made by this patch will be implemented in all future versions
NetWare 386. This patch and PATCHMAN.NLM (v2.23) will only operate
on NetWare 386 v3.11. Future versions of NetWare 386 will require a
version of PATCHMAN specific to that release.

**************************************************************************
                                 DISCLAIMER
 Novell, Inc. makes no representations or warranties with respect to any
NetWare software, and specifically disclaims any express or implied
warranties of merchantability, title, or fitness for a particular purpose.

Distribution of any NetWare software is forbidden without the express
written consent of Novell, Inc.  Further, Novell reserves the right to
discontinue distribution of any NetWare software.

Novell is not responsible for lost profits or revenue, loss if use of the
software, loss of data, costs of re-creating lost data, the cost of any
substitute equipment or program, or claims by any party other than you.
Novell strongly recommends a backup be made before any software is
installed.   Technical support for this software may be provided at the
discretion of Novell.
*************************************************************************

========================== ALERT.DOC =================================
                                MEDIA ALERT

                      NOVELL ENHANCES NETWARE SECURITY


Novell today announced that it has enhanced NetWare security by developing
and making available software enhancements for its NetWare v3.x, NetWare
v2.x and NetWare for Unix customers.  These enhancements are designed to
counteract a recently discovered security threat to network operating
systems.

The security threat, proven in a Netherlands academic laboratory, is not
currently found in commercial environments and requires the hacker to forge
requests on the wire in the name of a more privileged user.  However, Novell
considers any threat, even a potential threat, to network security to be
serious and has worked quickly to develop and provide solutions for its
customers.

Because this security threat affects other network operating systems, it is
an industry-wide problem.  In addition to being the first to address this
security threat for its customers, Novell is willing to work closely with
other companies in the industry to ensure that in general networks are as
secure as possible.

Novell is also continuing its education efforts to ensure that customers
have the most secure network environments available.  Novell recommends
that all customers who are concerned about security activate all applicable
NetWare security features and install the most recent versions of system
software, client software and patches.

Novell will make the software enhancements available on NetWire and NetWare
Express for NetWare v3.x and NetWare v2.x customers.  The enhancements will
also be given directly to NetWare for Unix partners so that they can make
the solution available to their customers.

========================== TBP287.DOC ================================
                          NOVELL TECHNICAL BULLETIN

          TITLE:    Physical Security of a NetWare Server
   DOCUMENT ID#:    TB.P.287
           DATE:    12APR91
        PRODUCT:    NetWare
PRODUCT VERSION:
     SUPERSEDES:    NA

        SYMPTOM:    NA

ISSUE/PROBLEM

   It is necessary to reiterate the need to physically secure a NetWare
   server.  Some NetWare administrators may not be aware of this security
   measure.  Precautions, such as those implemented in the mainframe and
   minicomputer environment, should also be taken to physically protect the
   server from unauthorized use in a NetWare environment.  If the server is
   not secured in a locked area, unauthorized users may be able to down the
   server and remove devices; destroy data and system configuration; and
   otherwise gain access to sensitive information.

   In addition to securing the server, NetWare provides a number of security
   features that help protect the server console and system from misuse.
   The following are functions that can be used to enhance server security
   on a NetWare operating system.

     *    Issue the SECURE CONSOLE command from a NetWare v3.x console.  By
          doing this, the system will only load NLMs from SYS:SYSTEM.

     *    Select Lock File Server Console from the NetWare v3.x MONITOR.NLM
          main menu.  This will password-protect the server console.

     *    Protect RCONSOLE.NLM from a NetWare v3.x system with a password.

     *    Use other security features of NetWare v2.x and v3.x such as
          intruder detection, forced password changes, limited grace logins,
          etc.

     *    Use server hardware password protection if available.

   These advanced features enhance system security, but do not remove the
   need to place the server in a secure location.  NetWare security features
   combined with physical protection of the server affords the system
   administrator the highest server security possible in the NetWare
   environment.

------------------------+-------------------------------------------------
 Brett Warthen          |        MHS:  Brett @ Infinite (via NHUB/CSERVE)
 Infinite Technologies  | CompuServe:  >MHS:Brett@Infinite
 11433 Cronridge Drive  |   Internet:  Brett@Infinite.mhs.compuserve.com
 Suite H                |        FAX:  +1-410-363-3779
 Owings Mills, MD 21117 |       Fone:  +1-410-363-1097
------------------------+-------------------------------------------------
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU