DATA Directory Security Problem

Thread View: comp.os.netware.security

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Joshua Vaughn Wed, 06 Nov 1996 00:00

Author: Joshua Vaughn
Date: Wed, 06 Nov 1996 00:00

49 lines
2432 bytes

This is actually a companion post to an article I posted called
"EXPLICIT Rights Question".  I thought if I rephrased the problem
I might get better results in achieving what we're trying to do.

We're in the process of designing the SYS:DATA directory structure and
security for our organizations Netware 3.12 servers.  We would like it
to meet the following requirements:

1)  EVERYONE has access to SYS:DATA   [R W E C F M]

2)  Our departments each have thier own GROUP DIR under SYS:DATA;
     (ie.  SYS:DATA\EXEC;  SYS:DATA\ADMIN)
   
     Each GROUP DIR has it's own corresponding NETWARE GROUP

     Each NETWARE GROUP gets a trustee assignment of [R W E C F M]
     to it's corresponding GROUP DIR   

     Each GROUP DIR has an IRM at it's head which blocks all rights to
     other users/groups

NOTE:  NETWARE GROUP EXEC must have [R F] to all GROUP DIR's
             and USER DIR's

3)  Every user has a USER DIR in thier appropriate GROUP DIR with the

     [S] right to thier own directory

    Peer users get NO rights to other users directories

    Department heads get [R F] to other users USER DIR's in thier     
    GROUP DIR

    In the event there is more than one dept head in a group,  the
    second manager get's the [R F] assignments in USER DIR's 
    of thier subordinates,  NO rights in the first managers directory


The DILEMMA:  What is the most effective way to grant trustee rights
to the group directories for the Netware groups,  while blocking
rights to peer directories for peers,  granting [R F]  to dept heads,
AND granting global [R F] to the EXEC Netware group.  

I've been wrestling with this for a couple of days now;  if there is
an efficient way to pull this off I haven't come acrost it yet.  It
would be great if this plan could come together...ideas?

Re: DATA Directory Security Problem

Author: Matt Beauregard
Date: Sat, 09 Nov 1996 00:00

49 lines
2807 bytes

zonk@albany.net (Joshua Vaughn) wrote:

>1)  EVERYONE has access to SYS:DATA   [R W E C F M]
>2)  Our departments each have thier own GROUP DIR under SYS:DATA;
>     (ie.  SYS:DATA\EXEC;  SYS:DATA\ADMIN)
>     Each GROUP DIR has it's own corresponding NETWARE GROUP
>     Each NETWARE GROUP gets a trustee assignment of [R W E C F M]
>     to it's corresponding GROUP DIR   
>     Each GROUP DIR has an IRM at it's head which blocks all rights to
>     other users/groups
>NOTE:  NETWARE GROUP EXEC must have [R F] to all GROUP DIR's
>             and USER DIR's
>3)  Every user has a USER DIR in thier appropriate GROUP DIR with the
>     [S] right to thier own directory
>    Peer users get NO rights to other users directories
>    Department heads get [R F] to other users USER DIR's in thier     
>    GROUP DIR
>    In the event there is more than one dept head in a group,  the
>    second manager get's the [R F] assignments in USER DIR's 
>    of thier subordinates,  NO rights in the first managers directory

Consider the following modifications:
1. Create the directories F:\GROUPS and F:\USERS
2. Under each create department directories like F:\GROUPS\ADMIN and
F:\USERS\ADMIN
3. Create a directory for each user in his department under F:\USERS
4. Create a director F:\GROUPS\COMMON

Then allocate these rights:
1. SRWCEMFA to the EXEC group for F:\GROUPS and F:\USERS
2. RWCEMF to EVERYONE for F:\GROUPS\COMMON
3. RWCEMF to each Group for its directory under F:\GROUPS
4. RF to each Dept. head for his group's directory under F:\USERS
5. SRWCEMFA to each user for his personal directory in F:\USERS
6. An IRM of SA for Department Head user directories if there are two
department heads

This scheme is simpler to implement and requires less fiddling with
IRMs to achieve basically the same result. If you set up two drive
mappings (say, G: for the group and H: for the user's home) there
should be no loss of convenience for having split the data directory
into two arms.

I'd appreciate your opinion since we're looking at having to do a
similar reshuffle at our site sometime soon.

-Matthew

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads