From: shephard@fraser.sfu.ca (Gordon Shephard)
Subject: Novell Security - SECURE.ZIP
Summary: New File from Novell - Secure.zip
Keywords: Novell Security
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Sun, 27 Sep 1992 04:50:27 GMT

Well, we're finally getting an official response from Novell:
(Sigh, they could have referred to the Wire-Breaker as a Cracker)

Found at ftp.novell.com in NOVLIB/03 - secure.zip, 

------------------------------------------------------------------------------

				MEDIA ALERT

		      NOVELL ENHANCES NETWARE SECURITY


Novell today announced that it has enhanced NetWare security by developing
and making available software enhancements for its NetWare v3.x, NetWare
v2.x and NetWare for Unix customers.  These enhancements are designed to
counteract a recently discovered security threat to network operating systems.

The security threat, proven in a Netherlands academic laboratory, is not
currently found in commercial environments and requires the hacker to forge
requests on the wire in the name of a more privileged user.  However, Novell
considers any threat, even a potential threat, to network security to be
serious and has worked quickly to develop and provide solutions for its
customers.

Because this security threat affects other network operating systems, it is
an industry-wide problem.  In addition to being the first to address this
security threat for its customers, Novell is willing to work closely with
other companies in the industry to ensure that in general networks are as
secure as possible. 

Novell is also continuing its education efforts to ensure that customers have
the most secure network environments available.  Novell recommends that all
customers who are concerned about security activate all applicable NetWare
security features and install the most recent versions of system software,
client software and patches.

Novell will make the software enhancements available on NetWire and NetWare
Express for NetWare v3.x and NetWare v2.x customers.  The enhancements will
also be given directly to NetWare for Unix partners so that they can make
the solution available to their customers.

----------------------------------------------------------------------
AND....
----------------------------------------------------------------------

             README FOR SECUREFX.NLM and SECUREFX.VAP

The following files are included: 

SECUREFX NLM   1960   09-25-92   1:54p
SECUREFX VAP   8736   09-25-92  10:54p
ALERT    DOC   1699   09-25-92   6:58p
PATCHMAN NLM   9051   04-16-92  11:21a
PCHMN223 DOC   6110   05-07-92   4:33p
TBP287   DOC   2105   09-25-92   5:17p
SECUREFX DOC   (this file)


Purpose:
SECUREFX.NLM and SECUREFX.VAP are designed as an enhancement to the existing 
security features in the NetWare v3.11 and v2.2 Operating Systems respectively.


SECUREFX.NLM FOR NETWARE v3.11
-------------------------------
When a security violation is detected, the following notification messages 
will be displayed at the file server console, at all attached workstations, 
and written to the error log: 

"Security breach against station <connection number> NEUTRALIZED."  

In addition, the message 

"Connection TERMINATED to prevent security compromise"

will be written to the error log and displayed at the server console. 

By default, the connection whose security would have been breached will be 
terminated when SECUREFX.NLM detects a security violation. If the user wishes
to be notified of an attempted security breach without terminating any user
connections, the command line parameter "-NK" should be used when loading
SECUREFX.NLM.  When the -NK option is used, the following notification
message will be displayed at the server console, at all attached workstations, 
and written to the error log:

"Security breach against station <connection number> DETECTED."  

SECUREFX.NLM is intended for all number-of-user versions of the NetWare v3.11 
Operating System.  SECUREFX.NLM is a dynamic patch which is loaded at the 
file server console as a NetWare Loadable Module. SECUREFX.NLM requires the 
latest version of PATCHMAN.NLM (v2.23) in order to load.

Unlike previous patches, the SERVER.EXE file is never modified by this
patch. SECUREFX.NLM patches the Operating System in memory, not on
the disk.  This means that SECUREFX.NLM must be loaded each time
before any "fixes" take effect. It is recommended that the command "LOAD
SECUREFX" be placed in the server's AUTOEXEC.NCF file to ensure that
the patch is always in effect when the server is initially brought up. In
the event that the -NK option is desired, the command "LOAD SECUREFX -NK" 
should be placed in the AUTOEXEC.NCF.  This "NK" must be in upper case. 

Since it is an NLM, SECUREFX.NLM can be loaded and unloaded without
ever having to bring the server down. Once loaded, the Operating System
is patched and ready to go. Unloading SECUREFX will restore the
Operating System to its original "un-patched" state.

Like all NLM-type patches, SECUREFX.NLM requires the Patch Manager
(PATCHMAN.NLM) to be loaded before it can be loaded.  If PATCHMAN
is not already loaded, SECUREFX will attempt to locate PATCHMAN and
load it automatically if found. PATCHMAN only needs to be loaded once.
All other patches can load once PATCHMAN is loaded. PATCHMAN
cannot be unloaded until all patches that rely on it are first unloaded.
Typing "Patches" at the system command line once PATCHMAN is loaded
will display all patches currently loaded on the filefile server. 

To install SECUREFX.NLM, simply place the SECUREFX.NLM file in the
same directory as the other NLM files (SYS:SYSTEM or DOS partition), and
type "LOAD SECUREFX" (or "LOAD SECUREFX -NK").  Once the patch has loaded,
all changes are in effect until SECUREFX is unloaded.  If an error message
appears, contact Novell Technical Support.

The changes made by this patch will be implemented in all future versions
NetWare. This patch and PATCHMAN.NLM (v2.23) will only operate
on NetWare v3.11. Future versions of NetWare will require a version of 
PATCHMAN specific to that release.


SECUREFX.VAP FOR NETWARE v2.2
-----------------------------
SECUREFX.VAP is intended for all number-of-user versions of dedicated and
non-dedicated NetWare v2.2 Operating System.  

SECUREFX.VAP functions in a similar manner as SECUREFX.NLM, however, with 
SECUREFX.VAP, the notification message is only displayed at the file server
console, and is not broadcast to connected users or written to the error lo
To install SECUREFX.VAP,  place the SECUREFX.VAP in the directory where the 
other VAP files reside.	Reboot the file server and select "y" (yes) when 
prompted to load the VAPS. By default, SECUREFX.VAP will terminate the 
connection whose security would have been breached.  To use the -NK option 
defined above, input the following command at the server console:

:SECUREFX -NK

Use of the -NK option only detects a security breach and displays the 
notification message at the server console.

In order to reverse the effects of the -NK option, input the following 
command at the server console:

:SECUREFX -YK

******************************* NOTE ****************************************
For more information on this issue and general security issues refer to
ALERT.DOC and TBP287.DOC included with this zip file.
*****************************************************************************


***************************************************************************** 
                                 DISCLAIMER  
  
Novell, Inc. makes no representations or warranties with respect to any
NetWare software, and specifically disclaims any express or implied
warranties of merchantability, title, or fitness for a particular purpose.  

Distribution of any NetWare software is forbidden without the express
written consent of Novell, Inc.  Further, Novell reserves the right to
discontinue distribution of any NetWare software.

Novell is not responsible for lost profits or revenue, loss of use of the
software, loss of data, costs of re-creating lost data, the cost of any
substitute equipment or program, or claims by any party other than you. 
Novell strongly recommends a backup be made before any software is
installed.   Technical support for this software may be provided at the
discretion of Novell.
***************************************************************************

----------------------------------------------------------------------------

Finally,...

----------------------------------------------------------------------------

                          NOVELL TECHNICAL BULLETIN

          TITLE:    Physical Security of a NetWare Server
   DOCUMENT ID#:    TB.P.287
           DATE:    12APR91
        PRODUCT:    NetWare
PRODUCT VERSION:    
     SUPERSEDES:    NA

        SYMPTOM:    NA

ISSUE/PROBLEM

     It is necessary to reiterate the need to physically secure a NetWare
     server.  Some NetWare administrators may not be aware of this security
     measure.  Precautions, such as those implemented in the mainframe and
     minicomputer environment, should also be taken to physically protect the
     server from unauthorized use in a NetWare environment.  If the server is
     not secured in a locked area, unauthorized users may be able to down the
     server and remove devices; destroy data and system configuration; and
     otherwise gain access to sensitive information.

     In addition to securing the server, NetWare provides a number of security
     features that help protect the server console and system from misuse. 
     The following are functions that can be used to enhance server security
     on a NetWare operating system.

         Issue the SECURE CONSOLE command from a NetWare v3.x console.  By
          doing this, the system will only load NLMs from SYS:SYSTEM.

         Select Lock File Server Console from the NetWare v3.x MONITOR.NLM
          main menu.  This will password-protect the server console.

         Protect RCONSOLE.NLM from a NetWare v3.x system with a password.

         Use other security features of NetWare v2.x and v3.x such as
          intruder detection, forced password changes, limited grace logins,
          etc.

         Use server hardware password protection if available.

     These advanced features enhance system security, but do not remove the
     need to place the server in a secure location.  NetWare security features
     combined with physical protection of the server affords the system
     administrator the highest server security possible in the NetWare
     environment.


----------------------------------------------------------------------------