Setting a user to be an administrator equivalent grants them all of the administrator user's rights. Unauthorized users who have acquired access can use this to permanently provide administrator access to their account.
To check if there are users having unauthorized equivalence, perform the following steps in Identity Console:
Click the User Management option from the Identity Console landing page.
Select a user.
Under Modify Object, go to Security tab.
In the Security Equal to Me option, check that no accounts have been set as equal to your administrator accounts that are not authorized to do so.
Make sure you use a User template object when creating a user account. It ensures that the necessary security-related configurations have been completed. You can use custom forms for user account in Identity Console. For more information, Managing Custom Forms.
Even without authenticating to eDirectory, users can attach to the directory and browse through the contexts and users by default. Security best-practices recommend only allowing authenticated users to see only the users and objects that they need access to
Assign privileges based on job function, like organizational role, specific groups, or container objects. It is recommended not to assign privileges to any group where all users are members.
It is easy, but violates a basic security principle, to assign more rights than what are necessary for a user to perform the work they are authorized to perform. Determine what rights are needed by each person that is performing work on your system, then ensure that the minimum rights are assigned to allow the user to perform their work.
The [Root] object is the top object in any eDirectory tree. Unless the rights given at the [Root] are blocked from being inherited, any rights assigned here flow down throughout all parts of the tree. Aside from the primary eDirectory administrator user object, other users, groups, organizational roles, or container objects should not have access to the [Root] object without a specific organizational need.
Typical objects seen as trustees of [Root] are objects such as [Public] with only Browse Entry Rights, [Root] with only Browse Entry Rights, one or more administrator user, group, or organizational role objects with full rights including Supervisory rights, and Role Based Services objects with Supervisor Entry Rights. Any unknown objects with Supervisory rights or with rights that exceed Browse Entry Rights, especially to the All Attributes Rights or Entry Rights are a concern and should immediately be investigated.
WARNING:Removing a rights or trustee objects from the [Root] that are required to be there by some process may cause certain processes or authentications to fail. However, failing to secure the [Root] object properly exposes your entire tree to unauthorized access and modifications.
The top-level container(s) in an eDirectory tree should be examined for objects in the tree, such as users, groups, containers, organizational roles, with unauthorized access privileges.
Examine the trustee rights on the top-level Organization or other top-level containers, this includes all objects directly under the Root object.
Look for unauthorized objects, such as users, groups, containers, or organizational roles that have been given access to this container and usually all child containers and objects.
NCP Server objects are Linux Novell Core Protocol servers, which are typically file servers with clients running the Novell Client software. Ensure that all non-administrator users have no more than Browse, Compare, and Read rights.
Perform the following tasks:
Examine the trustee rights on the top-level Organization or other top-level containers, this includes all objects directly under the Root object.
Look for unauthorized objects, such as users, groups, containers, or organizational roles that have been given access to this container and usually all child containers and objects.
Inherited rights filters (IRF) are used to block rights inheritance in the tree. This method of limiting access should be used sparingly, because it becomes difficult to determine where rights are being inherited.
Additive rights: directly assigning rights to all objects, versus subtractive rights: assigning rights at a higher level and then removing rights from specified lower levels, are normally less complex and easier to administer. You should only use IRFs in limited-scope cases where directly assigning all of the rights is more complex than using IRFs.
Say for instance, that a parent container and all children but one should allow all users browse access, but that one child container should be hidden from all users. Assign access only to organizational roles and groups directly to the objects and folders that organizational role or group requires. Be aware that the default behavior for rights is to flow down and be inherited by all child containers and objects.
Use effective rights testing to ensure that proper rights are assigned to applicable objects.
WARNING:Be cautious when using an IRF to block supervisor rights. Normally, you are required to directly assign another supervisor-rights object to the object that you are using an IRF to block supervisor rights to.
The use of security equivalence or “security equal to me” settings on a user object is an easy, but outmoded use of security privileges. It is a better practice to and easier to audit by assigning access privileges through organizational roles or groups.
It is also easy for administrators who have set up the equivalence or other administrators unfamiliar with the user equivalence to delete the user object that the other users are equivalent to, thus wiping out the only record of all the privileges and forcing a backup restore or rebuilding all of the required privileges from scratch.
Create an organizational role or group object. Assign the rights to this object that you desire your security equivalent objects to have. Locate all objects using the security equivalence setting. Make the user object a member of the group or organizational role object. Remove the security equivalence.
To locate objects using security equivalence, perform the following steps in Identity Console:
Click the Search option from the Identity Console landing page.
In the Search window, select type as user and click on search icon next to it to open advanced search window.
Select attribute as security equals and operator as is present.
Click OK.
The users who have used “Security equals” are listed. Similarly, one can filter by “Security equals to me” and make the necessary modifications in accordance with security requirements.