X-Envelope-to: novell@suvm.bitnet
X-VMS-To: IN%"novell@suvm.bitnet"
X-VMS-Cc: JRD
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Newsgroups: bit.listserv.novell
Date:         Wed, 18 Nov 1992 20:25:07 -0600
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Joe Doupnik <JRD@USU.BITNET>
Subject:      New Novell security suite

        Novell security files issued this week - an update.

        On Monday I sent a message concerning what happened to my NW 3.11
file server when installing all of the new security files. I now have more
information to offer on the matter, but not the whole story.
        To recapitulate, the server crashed when booting. The crash was at
the point of loading NFS v1.1. It is now known that the new CLIB.NLM +
MATHLIBC are not compatible with that older version of NFS (current release
level is 1.2). Novell says NFS v1.2 should be ok.
        The second server crash occurred when logging in with the new BNETX
shell component and the new PBURST.NLM was loaded. Experiments here indicate
the trouble is in the new PBURST.NLM. Both cases have been reported to
Novell and the first has been confirmed already.

        That's all the bad news. Now for some good news.
        BNETX (new) has worked fine with Windows 3.1 enhanced mode. Yeah!
I simply use the original PBURST.NLM, v1.0, from earlier this year.
        BNETX and NETX seem better now. For example, I used to see trash in
the Rconsole server selection window, but not today. And it seems they are
just a little faster than the older material, but maybe my imagination wants
them to be so.
        Since I need NFS and v1.1 is the only flavor on hand I have declined
to load CLIB/new again, but most of the other utilities seem to work ok. I've
switched to the new shell components (ODI) and new LOGIN.EXE, etc. A new NFS
will be here in due course and I'll make the full jump then.
        Here are two suggestions on approaching these things the safe way
(vs plunging ahead as I did rapidly Monday afternoon: when is there time for
thinking on Mondays??). For core components such as CLIB and MATHLIBC, put
them on a floppy and modify autoexec.ncf to use A: as a path prefix in the
load statments. Then if the server is unhappy, restart it with SERVER -NA
to omit reading autoexec.ncf, load install, edit out the A:, down/up the
server and things should be intact again. On the majority of the utilities
in the suite: these are DOS executables and can be run from a local drive
first and thus leave the older ones in place on the server. Once you are
satisfied then move them to the server.
        And here is another thought on the security files. They were published
on NEWS as well as NetWire and ftp.is.sandy.novell.com. Guess which are the
more reliable sources?  Ok, now guess which channel ultimately reaches more
systems? Very good.
        Tuesday Novell issued two modified files, replacing those of Monday.
I expect to see further re-releases as folks get a chance to try the programs
on a wide variety of systems. It is clear from the internal timestamps that
Novell has taken a calculated risk in releasing the material at this time,
and that risk was to provide some protection to customer sites Now, even if
some bugs or incompatibilities remain undetected. So, rather than being upset
by new editions we should understand the massive effort behind the files.
        The files are sec*.exe, in directory novlib/novfiles, on master site
ftp.is.sandy.novell.com, and on selected other servers (such as my faithful
NW 3.11 netlab2.usu.edu, and remirrored from it via NFS v1.1 to my Unix machine
netlab1.usu.edu for the Unix types). I now have an auto-mirroring program
operating such that I can keep my copies in sync with Sandy on a daily basis.
        The alarm bell is off, please go ahead and sample the waters.
        Joe D.
Xref: sparky bit.listserv.novell:17459 comp.sys.novell:9595