WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Windows 2000 Professional and NetWare Security

Although Windows 2000 Professional and NetWare security structures are not directly equivalent, you can maintain security when transmitting data from one security structure to the other.

The following sections describe how Microsoft permissions are translated to NetWare rights in a heterogeneous environment using Windows 2000 servers and workstations and NetWare servers.

NOTE

---

For more information about Windows 2000 Professional security, see "Security" in this book.

Windows 2000 Professional Permissions

You can protect Windows 2000 Professional file allocation table (FAT) partitions and partitions using the version of NTFS included with Windows 2000 Professional against network access using share-level security. However, you can protect only NTFS file system partitions with user-level security.

NetWare Trustee Rights

NetWare file security is similar to NTFS security because you can control group and user rights to access files, called rights in NetWare. A NetWare trustee right, which is equivalent to a Windows 2000 permission, is a rule associated with an object (usually a folder, file, or printer) that regulates which users can gain access to the object and in what manner. Typically, the creator or owner of the object sets the permissions for the object.

The primary design difference between Windows 2000 permissions and NetWare trustee rights are that Windows 2000 permissions are subtractive and NetWare trustee rights are additive. When you create folders and files in Windows 2000, full access is granted and then access rights can be subtracted or restricted; in NetWare when you create a directory or file, access is denied and then access rights are added.

NetWare uses a combination of trustee assignments and inherited rights masks, or filters, to establish security settings. The intersection of these two access control mechanisms determines the actual access rights, known as NetWare effective rights, that a user or group has for a particular directory or file. There are eight NetWare directory rights settings: Read, Write, Create, Erase, Modify, File Scan, Access Control, and Supervisor.

The NetWare directory rights, are descibed in Table 24.7.

Table 24.7 NetWare Directory Rights

Windows 2000 Professional Folder Permissions and NetWare Directory Rights

Table 24.8 shows how Windows 2000 Professional folder permissions correspond to NetWare directory rights.

Table 24.8 Windows 2000 Professional Folder Permission to NetWare Directory Rights

Windows 2000 Professional File Permissions and NetWare File Rights

Table 24.9 shows how Windows 2000 Professional file permissions correspond to NetWare file rights.

Table 24.9 Windows 2000 Professional File Permissions to NetWare File Rights

Windows 2000 Professional and NetWare File Attributes

NetWare file attributes, also known as flags, are not exactly the same as Windows 2000 Professional file attributes. Table 24.10 shows how Windows 2000 Professional file attributes correspond to NetWare file attributes when you open a NetWare file through Client Service for NetWare. The four attributes shown are a subset of many attributes supported by NetWare. Windows 2000 Professional does not support any additional NetWare file and directory attributes.

Table 24.10 Windows 2000 Professional and NetWare File Attributes

When you copy a file from a Windows-based network client to the NetWare file server by means of Client Service, the A, S, H, and R attributes are assigned the corresponding NetWare A, Sy, H, and Ro attributes.

When you use a computer running Client Service to access NetWare servers and you need to set attributes that are not supported by Client Service, you can use NetWare utilities, such as the filer, rights, or flag command, from the command prompt to set those attributes.

NDS Object and Property Rights

The NetWare NDS security structure adds NDS object and property rights to the directory and file rights in the NetWare bindery-based server security structure. In NDS, a network structure is organized by using NDS objects. Objects are components of the NDS hierarchical tree structure. The tree structure includes the following:

Root objects at the top of the tree.

Container objects, which are composed of various organizational units.

Leaf objects, such as users, groups, servers, and volumes.

The following NDS object settings exist: Supervisor, Browse, Create, Delete, and Rename.

Properties are contained within an object that represent that object. A user object can contain properties such as a user telephone number, office location, and title. Property rights are implemented as a separate security structure than object rights in the NetWare NDS security structure. Therefore, you can configure security separately for objects and object properties. The following five object properties exist: Supervisor, Compare, Read, Write, and Add/Delete Self.

NOTE

---

NDS object and property rights apply only to NetWare NDS volumes, and you can change them only by using the NetWare network operating system software.