This section provides more information about configuring access rules, how to build access control lists, and presents several examples. It contains the following subsections:
Novell BorderManager allows you to configure each access rule as either an Allow rule or a Deny rule. Allow rules allow a request to be fulfilled; Deny rules deny the request. You can take two different approaches when you set up your Novell BorderManager access control scheme, as follows:
In a tightly controlled environment, you might want to configure only Allow rules. If a user’s access request fails to match any of the access rules in an entire access control list composed only of Allow rules, the Novell BorderManager denies the default action (deny).
In a loosely controlled environment, you might want to configure only Deny rules with an Allow Any rule at the end of the access control list. If a user’s access request fails to match any of the Deny rules in the access control list, it is allowed by the last Allow Any rule.
As stated previously, Novell BorderManager adds together all the individual access control lists defined at all the different levels of the NDS or eDirectory tree in your network, starting from the Server object, continuing through the container holding the Server object, and concluding at the root of the eDirectory tree.
Within this consolidated list, access control lists defined at the Server object are placed at the beginning, access control lists defined at the root are placed at the end. In other words, rules defined closer to the user are placed closer to the top of the server’s access control list. This combined list is the access control list for the Novell BorderManager server, and it is applied to every access request received by the server.
Within each access control list, Novell BorderManager uses the sequence of access rules in the access control list to determine which rule takes precedence. A rule closer to the top of the list always takes precedence over any rule that follows it in the list. The first rule that matches the access request is the rule that is applied to the access request. If you mix conflicting Allow and Deny rules in an access control list, then you must ensure that the sequence of rules in the list produces the desired effect.
Each time a user makes an access request, such as when a Proxy Services or VPN user initiates a request to access a particular service or destination, Novell BorderManager checks the server’s access control list. It searches the list until it finds the first access rule that applies to the requesting object, then it acts immediately on the rule to allow or deny the request. Intelligent sequencing is essential when you create access control rules because Novell BorderManager searches for the first applicable rule in the server’s access control list. It does not search for any potentially applicable rules after that.
Suppose your company president wants a rule that keeps company employees from accessing the World Wide Web during work hours. You can accomplish this blanket policy with one general access rule at the root of the tree that contains your Novell BorderManager server.
If the vice president of Marketing insists that his people must have access to the Web to perform their jobs effectively, you can satisfy his request with a second rule that you create for the Marketing user group or for specific users within that group.
This approach is one way to implement access rules on your Novell BorderManager server. You use general rules placed higher in the eDirectory tree for far-reaching policies that you want to effect, such as keeping employees from accessing the Web during work hours. You use specific rules placed lower in the NDS or eDirectory tree for more specific cases or exceptions, such as allowing the Marketing group to have access to the Web during business hours.
When two rules conflict with each other (Deny everyone Web access during business hours and Allow members of the Marketing department to access the Web during business hours), the rule closer to the beginning of the server’s access control list takes precedence. When no rule is found, the request is denied because the server’s default action in the absence of a specific rule is always Deny.
In this example, the administrator for XYZ Communications creates the following rules on the XYZ Novell BorderManager server:
Table 3-2 Access Control Rules
An analysis of the preceding access rules raises the question of whether the administrator really needs to configure the three Deny rules. Novell BorderManager will automatically deny the user’s access request when it reaches the end of the access control list if the request does not match any rule in the list. The answer is it depends on what the administrator wants to accomplish.
An examination of Rule 4, which denies any users in the xyz.com group access to www.digitalairlines.com, and Rule 8, which allows any user in xyz.com to access any destination, reveals that Rule 4 (deny) is necessary.
Rule 7 denies user access to any Web pages inside the innerweb.xyz.com/prv directory after Rules 5 and 6 allow the Finance group and Human Resources group to access their own Web directories.
However, Rule 2 allows any user in xyz.com to access innerweb.xyz.com, which allows access to the pages inside the innerweb.xyz.com/prv directory. Rule 3 allows any user in the exec.xyz.com group to access any destination, which also allows access to pages inside the innerweb.xyz.com/prv directory.
If the administrator does not want users in the xyz.com group to access the innerweb.xyz.com/prv area, then Rule 2 should be moved after Rule 7 (deny). However, if the administrator wants users in the exec.xyz.com group to have access to the innerweb.xyz.com/prv directory, then Rule 7 is not needed.
Rule 8 allows any user in xyz.com to access any destination, which also allows any user to access the host, innerweb.xyz.com. This makes Rule 2 unnecessary. The administrator can also delete Rule 9 because, by default, Novell BorderManager automatically denies user access requests at the end of the access control list when the request does not match any specific rule in the list.
The final access control list looks like the following:
Table 3-3 Final access control list
An analysis of the preceding access control list reveals that any user in xyz.com can access any destination (Rule 7), except the www.digitalairlines.com and innerweb.xyz.com/prv directories (Rule 3 and Rule 6).
Now consider the following requests:
Can Amy Brentman of the XYZ Finance department use HTTP to connect to www.digitalairlines.com, the Web site of Digital Airlines and the current rival of XYZ Communications?
If Amy made this request, the access rules would work as follows:
Rules 1 and 2 do not apply to Amy’s request.
Rule 3, however, says that all XYZ employees in all XYZ departments are denied HTTP requests to the Web site of rival Digital Airlines.
Rule 7 does allow all XYZ employees in all XYZ departments to use HTTP to connect with any location, but Novell BorderManager already acted on Rule 3, the first rule in the access control list that matched the request.
The answer is No, Amy cannot access www.digitalairlines.com.
Jose Lira works in the Human Resources department of XYZ Communications (hr.xyz.com). Can Jose use FTP to copy files from innerweb.xyz.com/prv/hr?
The access rules would work as follows:
The user request is denied because it does not match any rule in the access control list (FTP is not specified in Rules 1 through 7).
However, Rule 5 does allow Human Resources (hr) employees like Jose to use HTTP to connect to innerweb.xyz.com/prv/hr.
Jose can access the site but not he cannot use FTP to copy the files.
P.V. Singh, President of XYZ, is a member of exec.xyz.com. Can P.V. use FTP to copy files from www.digitalairlines.com?
The access rules would work as follows:
Rule 2 allows P.V. to use FTP to copy files from www.digitalairlines.com because it allows any member of exec.xyz.com to use any service to connect to any location.
Rule 3 denies any XYZ employee access to www.digitalairlines.com, but it does not apply because Novell BorderManager has acted on Rule 2.
P.V. can use FTP to copy files from www.digitalairlines.com.
Roger Rockwell has been in charge of the XYZ Shipping and Receiving department for years. This year, his department was added to the company’s intranet. Roger is curious to see what kind of company Web locations are under innerweb.xyz.com/prv.
Rules 1 through 5 do not apply to Roger’s request.
Rule 6 denies Roger’s request because it denies all requests by XYZ employees to innerweb.xyz.com/prv.
Roger cannot see any location under innerweb.xyz.com/prv.
You can also specify periods of the day and days of the week when an access rule is to be in effect, and you can specify that you want all requests against an access rule to be logged.