This applies to both eDirectory Admin and server administrator.
The Administrator account created during eDirectory installation have full rights to the eDirectory components. This account must be secured. To secure this account, read the following recommendations:
Do not place Administrator account in a container where there are other users.
It is recommended to store the eDirectory Administrator accounts in a separate directory context or container than regular user accounts. This reduces the possibility of unauthorized access attempts, which may compromise the password or temporarily disable the administrator account.
Do not use common names for Administrator account.
It becomes harder to discover the account, which reduces attempts at brute-force attack on the password or unauthorized access to temporarily disable the administrator account.
Set password restrictions for Administrator account.
When creating the Admin user, there are no password constraints in place. It is recommended to configure the standard eDirectory password restrictions for this account to satisfy the minimum security criteria for passwords. In Identity Console, select the User Management option, type the name and context of the object or use the search feature to find it, then click the Search button. Select the user object from the users list and click the Modify icon. Go to Restrictions and set the password restrictions for the account.
The password is not case-sensitive by default. For more information on how to make your password case-sensitive, see Enforcing Case-Sensitive Universal Passwords.
Set login restrictions for Administrator account.
Login restrictions are limitations set on user accounts to control network access. For example, when a user violates the login restriction by entering an incorrect or an expired password and exceeds the number of login attempts, the account gets disabled and stops any other user to log in using the same username. This measure ensures unauthorized users are unable to log in.
Note the following restrictions which are imposed in Identity Console for each user:
Make password mandatory. You can customize the requirements, such as set a minimum length, decide if it needs to be changed periodically and how often, make it unique, and enable the option for only strong passwords to be used. You can also restrict users from changing their passwords. For more information, see Managing Password Policies
Limit the maximum number of logins with an expired password and the maximum number of incorrect login attempts that can be made.
Set limits on the account, such as account balance and expiration date.
Limit the number of simultaneous connections that a user can have.
Specify (by node address) which workstations users can login to.
Restrict the time when users can log in (you can assign all users the same hours, or you can restrict users individually).
Device-specific or node-specific accounts can be restricted.
When you access services on a Novell Core Protocol (NCP) server using an eDirectory account, it is possible for eDirectory to limit access to a user account based on the requesting network address. This means that the user account can only be used by a specific device or node with a fixed TCP/IP (not a dynamic one using DHCP), such as a printer or other non-user entity. These types of account can be restricted to only allow authentication from certain network addresses.
You can set network address restrictions for service accounts and a particular user as well.
Login to Identity Console.
Select any user, then click Modify User > Restrictions > Address Restrictions and provide the IP Address as per requirement and save.
Configure LDAP proxy user.
LDAP, by default, uses the PUBLIC object to obtain permissions for retrieving information from eDirectory, which is insecure as it allows non-authenticated users to read that same information in eDirectory. To ensure secure LDAP connectivity, we recommend using an LDAP proxy user instead of relying on the PUBLIC object. However, it is important to ensure that this LDAP proxy user does not have access to sensitive areas of the tree, such as administrator users containers, server containers, or SLP scope containers.
Disallow anonymous bind on LDAP.
Allowing LDAP anonymous binds has an adverse impact on security, especially when public browse rights for the eDirectory tree have not been revoked. Therefore, it is recommended that the anonymous bind on LDAP be disallowed.
Set intruder detection policy.
eDirectory provides an option to disable specific accounts for a period of time if the number of invalid authentication attempts reaches a certain limit. This is critical for preventing attempts of brute-force attack from revealing accounts and passwords.
You can set up an intruder detection policy on the novell container, which is the container where the Admin user is created. To set up the policy in Identity Console, see Checking and Clearing the Intruder Lockout
Backup the Admin user.
When you install eDirectory, just one Admin user is created. If you forget the username or password, you will not be able to access eDirectory. To avoid this, it is recommended that you create a backup user who has the required privileges of an Admin user.
Set strong password policies for eDirectory administrator and system administrator.
Reset the admin account if you forget account credentials.
Disable password retrieval for eDirectory Admin account.
Use Multi-factor Authentication for Advanced Authentication and other products.
Disable simple passwords.
Using simple passwords to manage multiple password hashes for different services in eDirectory is not secure. It is recommended to enable Universal Password instead. Universal Password is a modern framework that offers password policies and services for Novell eDirectory. It ensures a consistent password policy across various authentication systems, including Native File Access. With Universal Password services, you can have case-sensitive passwords, use extended characters, and enforce advanced password policies like password complexity, which enhances security.
Enable account access time restrictions.
To enhance security, you may limit the active hours of certain accounts that should not be authorized to log in at certain times of the day.
Enable password policies.
To ensure secure authentication of user accounts, it is important to enforce restrictions on passwords. This can be done in eDirectory by setting specific attributes on user objects. Enabling Universal Password offers added security advantages such as case sensitivity. Be sure to follow the rule of enabling Universal password capabilities.
Limit concurrent connections.
To prevent account and password sharing, or multiple workstations being authenticated to eDirectory, it is recommended to restrict the number of times user accounts can be authenticated to a tree.
Remove or disable inactive account.
Inactive accounts are a security risk as they can be exploited to compromise a network system. It is recommended to deactivate accounts that have been inactive for 90 days or more.