Cryptography Operational Protocols and Algorithms

Leaving aside for a moment the issues of protocols and algorithms, the first choices to be made are the cryptographic strength of the system, embodied by choices of algorithm and key length, and some of the key-management questions. It is most important to choose truly random keys that are sufficiently long, keep those keys secret, and change keys "often enough." Again, this all supposes that you have selected a good cryptosystem; all the security of the system lies in the keys, and none in the algorithm itself.

We will consider key randomness and key secrecy shortly. For now, let us consider the selection of key length and the frequency of key updates.

Key Length

Given a reasonably strong algorithm, how well the data is protected depends largely on the length of the encryption key. Fundamentally, an encrypted message must remain secret for the useful life of the information. To a large extent, the value of the information in the encrypted message will govern the resources used to attack it. For example, an attacker would be foolish to spend $1 million to obtain information worth $1,000, but he might spend $1 million to obtain a secret worth $2 million. Here are some examples.

• Financial credentials must remain secret beyond their validity period.
• Contract bids must remain secret beyond the contract award.
• Editorial material must remain secret until published.
• Confidential personal information must remain secret beyond the lifetime of the individual.

Today, it is common to use 128-bit keys for symmetric algorithms, both for communications security and for the security of data to be protected for 20 years. The necessary key lengths for public-key algorithms vary considerably. The current recommendation for the RSA public-key algorithm, for example, is to use a minimum length of 1024 bits, with 2048 bits used for especially sensitive applications or longterm keys.

Key Updates

Cryptographic keys do not last forever; they need to be updated from time to time. The proper lifetime of a key is a function of the value of the items encrypted, the number of items encrypted, and the lifetime of the items encrypted. We have already discussed lifetime. If a key can be broken by a properly equipped adversary in 2 years, and the lifetime of information encrypted using the key is 6 months, then the key should be changed at least every 18 months so that an attack mounted on the first item encrypted will not succeed until after the last item encrypted loses its value.

The number of items encrypted is an issue for two reasons. First, if individual encrypted items have a market value, then the sum of the values of all encrypted items is the proper measure against which to balance the resources an attacker may bring to bear. Second, some cryptosystems can be attacked more easily when a large body of ciphertext is available. This effect is more difficult to quantify, but again, it is a good idea not to use a key for too long.

Another factor that leads to frequent key updates is paranoia. The longer a key has been in use, the greater the chance that someone has compromised the key storage system and obtained the key by subterfuge rather than by brute force attack.

It is important to note that changing a key does not increase the time that an attacker will need to find it using brute force or any other method of cryptographic attack. Changing keys does, however, limit the amount of information revealed if any particular key is found. For example, if the encryption keys are changed every month, then only one month's worth of information is disclosed if a key is discovered.

Perfect Cryptosystem One-Time Pads

Is there a perfect cryptosystem? Surprisingly, the answer is yes. It is called the onetime pad. The idea of the one-time pad is to have a completely random key that is the same length as the message. The key is never reused, and only the sender and the receiver have copies. To send, for example, a 100-bit message, the message is exclusiveORed' with 100 bits of the key. That portion of the key is crossed off, never to be used again. The receiver reverses the process, exclusive-ORing the ciphertext with her copy of the key to reveal the message. If the one-time pad key contains truly random bits, this scheme is absolutely secure. The attacker does not know what is on the pad and must guess—but there is no way to know when he is right. By changing the guess, the attacker can decode the ciphertext into any message, be it "attack at dawn" or "negotiate surrender."

The one-time pad offers perfect security and is indeed used when perfect security is needed, but the system has many disadvantages.

• The pad must be truly random. Any structure at all can be used to break the system. Creating truly random characters is difficult, and creating a vast quantity of them is more difficult.
• The pad must never be reused. If a sheet is used twice, then the two sections of ciphertext encrypted using the same page can be compared, possibly revealing both.2 Since the pad is consumed as messages are sent, the pad has to be very long or frequently replaced.
• The pads must be distributed, stored, and used with absolute secrecy. Because the ciphertext cannot be successfully attacked, the obvious point of attack is to copy or substitute a pad.
• Every pair of correspondents must have a unique pad, leading to immense practical difficulties of distribution.

These practical difficulties effectively restrict the use of one-time pad systems to situations in which cost is no object. For most other situations, cryptosystems are used in which the length of the key is fixed, and the key can be attacked by exhaustive search.

Putting New Data into SQLSpyNet with the DTS Wizard

The DTS Wizard is a very flexible tool that allows us to import data from almost any data source, including Excel, DB2, Oracle, Access, and even Text files. Why do we need this? Many organizations have data spread throughout the company. Charles will have a spreadsheet of his customers, Mary will have a small Access database that has all her suppliers, and Jenny, the secretary, might have a text file (word document) with the names and phone numbers of all the staff members.

With all of these disparate types of information floating around the office it's pretty obvious that data management can become a real nightmare! Duplication of data is inevitable, and retrieval is almost impossible.

But here comes SQL Server 2000 to the rescue! With the introduction of DTS in SQL Server version 7.0, many organizations have been able to relieve the pain of trying to get all these disparate pieces of information together. The DTS Wizard is a point-n-shoot approach to import (or even export) data into our database. We go through a series of steps, selecting the database into which to enter the data, where the data is to come from, and so forth.

This is all fine for simple data, but what happens when we have more complex data that doesn't have a clear definition between first name and surname? DTS can even take care of this, with your help of course.

Within a DTS package we can define VBScript that can be used to manipulate, format, or rerun a process. This gives us great flexibility when it comes to altering our data either before, during, or after the insert to the database.

There are many aspects to DTS packages, and we will only have a quick look at the basics. I suggest that you play with DTS packages in SQL Server 2000 because they rock! And the flexibility and control you have over the import/export process will surprise you.

Before we actually insert the data into our database, we are going to delete all the data out of our database. This will allow us to start from a clean slate. But just before we do this though, let's back up our database.

Backing Up the Database Before the Transfer

You might be wishing you didn't have to do this, but do you want to know the cool thing? You do not have to write the backup statement again! Because we wrote a backup task earlier (see Chapter 11, the section titled "Scheduling Jobs"), we can actually force it to run immediately. This means we can create a full database backup just by right-clicking on the job (under Management, SQL Server Agent, and then Jobs), and selecting Start Job.

You will see that the status of the job is set to executing. When the job has finished, the status will change to either Succeeded or Failed.

So there we go, a backup done nice and simply, with no extra code!

Debugging Stored Procedures

I have performed many tasks in numerous different roles, and one of the most frustrating has been debugging stored procedures. But no more! The ability to debug stored procedures as though we were debugging any development platform code is part of one of the enhancements to SQL Server 2000's Query Analyzer. We can insert break points, step into, step over, and so forth. This is wonderful for those of us who have tried to monitor what is happening in a stored procedure.

Previously we could do this with SQL Server 7.0 and Visual InterDev, but there was a lot of overhead in setting it up. With the new debugging tools, all we do is right- click and select Debug. How simple is that?

We have the standard debugging windows as well. We can get the values of variables from the Watch window and view the procedures that have been called and not completed in the Callstack window. This makes it easy to migrate from a development environment to using SQL Server 2000. So you Access developers out there must be getting really excited by now!

What? No More Room?

One of the trouble spots a DBA must keep an eye on is conserving a computer's most precious resources, memory and disk space.

If we have several databases on one server, we can find that we run out of disk space, and if that happens, our databases will fail.

Of course, in Spy Net's fictional scenario, that could mean World War III! But in the real world, running out of space can still cause serious problems, especially in mission-critical databases such as utilities or emergency response systems. In this section, we look at the causes of resource failure and several ways to avoid down time, including managing file and log size.

How Memory Affects Database Transactions

The memory-deprived databases will fail because tempdb is where most of the changes that you make to your data are performed before they are committed to disk. If you have enough RAM available, SQL Server 2000 will put as much of your database as it can up into RAM. After all, it is much faster to read from RAM than to scan a disk for the information. However, if RANI is a short commodity or you have concerns about the amount of disk space your database is eating, relax, because we have even have control over that.

When you are in Enterprise Manager you have the option to view how much space your data files for your database are allocated and how much is used. To see this information, simply click the SQLSpyNet (or any other) database within Enterprise Manager, and you will see a screen.

Shrinking Your Data Files to Reduce the Database

When we are talking about shrinking our data files we are not actually referring to the process of compacting them like a zip program would.

If we shrink our data files, we remove unused data pages. For example, if we had a table that had five data pages on which it stored the data, and we deleted two pages worth of the data, although our table would have only three pages that actually stored data, SQL Server 2000 still would have five pages allocated to the table.

When we shrink the data files, we just get rid of the extra two pages that the table was using. This does, however, have restrictions, but I think you get the idea.

What do we do when our data files are too large? Although we cannot shrink an entire database smaller than its original size, we can shrink our data files smaller than their original allocation sizes. We must do this by shrinking each data file individually by using the DBCC SHR I NKF I LE Transact-SQL statement. This allows us to reallocate how much space the given data file is allowed to use.

BadArticle Article Rewriter

BadArticle Article Rewriter (www.BadArticle.com) is a unique article rewriter which allows you to create two or more of the same article but with different synonyms and sentence structures. This helps your SEO go up dramatically as you can therefore have hundreds of “different” articles on the same topic which all have the same keywords. It is a brilliantly original idea and can save you hundreds of dollars paying people to rewrite your articles. It also means you can write using the same adjective all the time and the program will change it for you into intriguing words. Without spending any money, you could have tons of freshly exclusive content for people to read on your website!

We decided to try this cool program out and found it is as top notch as paying someone to rewrite it! It is a very easy tool to use and we think that this idea will be the way forward.

So, how does this new program work? Well, there are three different levels of rewriting, depending how different you want your article to be and the computer changes the synonyms and sentences to make new content (i.e. simple becomes plain).

Bad Rewrite

This only changes the most changeable synonyms. This means that your article will still be very legible and mistakes made by the computer aren't common.

Worse Rewrite

This changes most synonyms and therefore your article. It is very hard to tell the articles originated from one article. The database for this is huge, so don't worry about too many of just one word. This however, is slightly more illegible than just replacing the easiest to substitute.

Worst Rewrite

This completely replaces sentences but keeps your keywords. Sometimes this means the sentence turns out illegible, but it is usually a safe and quick way to get new content. (You may want to check it first for 100% accuracy)

Well, now you know how it works and how you can create tons of articles quickly and easily, or just spice up an existing article! We tested it with great results, as you can clearly see by the sample underneath.

So, here's the first sentence of this article rewritten:

“BadArticle Article Rewriter is an exceptional article rewriter which permits you to create two or more of the identical article but with varied synonyms and sentence arrangements.”

Although grammatically the sentence is not 100% correct, it still contains all the keywords and therefore boosts your SEO. In addition, if you wanted the new article to have top grammar, it will only take a second in Microsoft Word that integrated in the rewrite tool.

Personally, we decided that this is a very useful tool for bulk rewriting and content creation, but still found that we needed to correct some small errors. Therefore, for the versions of the future, maybe there will be a simple grammar checker just like in Microsoft Word.

Our final verdict on this program: Overuse it. It's the only free version of an article rewriter which we know of, plus it rewrites in less than 10 seconds! Why pay for hundreds of people's time when you have this powerful resource right in front of your very eyes!

Protocol Negotiation and Session Setup continue…

Readingand Writing

The SMB protocol uses the READ and WRITE message types to perform I/O operations on a file for the client. Using the READ request, a client can request that the server return information from the file by specifying a number of bytes and an offset into the file. The server returns the data, indicating the actual number of bytes returned, which can be less than requested if the user tries to read past the end of a file.

The WRITE command updates a file in a similar manner. The client sends in the data that will be written, indicating the number of bytes to write and an offset into the file where the write operation will begin. If the request causes a write past the end of the file, the file is extended to make it larger. The server sends a response telling the client the number of bytes that were written. If the number is less than the requested value, an error has occurred.

To increase read/write performance, the READ_RAW and WRITE_RAW message types can be used to exchange much larger blocks of information between the client and the server. When these are used, the client must have only one request issued to the server. In one send, the server will respond with data that can be as many as 65,535 bytes in length. The WRITE command works in the opposite direction, allowing the client to send a large buffer of raw data to the server for a write operation.

Locking Mechanisms

Locking allows a particular client exclusive access to a file or a part of a file when it is shared on th network. In SMB, the capability to create a lock is called an opportunistic lock, or oplock for short. This is better explained by looking at the way in which it works. A client can create a lock on a resource using three kinds of locks. The first is an exclusive lock, in which the client has exclusive access to the data held by the lock. A batch oplock is one that is kept open by the server when the client process has already closed the file. A Level II oplock is one in which there can be multiple readers of the same file.

The locking process consists of the client requesting the type of lock it wants when it opens the file. The server replies to the client with the type of lock that was granted when it responds to the open request.

A lock gives the client the capability to efficiently manage buffer space it uses when accessing a file over the network. For example, if a client has exclusive access to a file and is performing writes to it, it can buffer a lot of the newly written information before having to send it to the server to update the file. This can provide a reduced number of network packets when updating a file. A client that has an exclusive lock on a file can also buffer read-ahead data to make reading a file much faster.

These locks are called opportunistic locks for a reason. A client can be granted exclusive access to a file if no other client has it open at the time of the request. What happens when another client needs to read the file? The server notifies the first client that it needs to break the exclusive lock. The client then flushes its buffers so that any data that has not been written to the file is processed. The client then sends an acknowledgment to the server that it recognizes that the exclusive lock has been broken.

Batch oplocks are used to reduce the amount of traffic on the network when some programs require continual reopening of a file to obtain commands, as when a batch command procedure is executed.

For example, a batch procedure executed by the command processor usually opens a file, locates the next line to be executed, reads that line, closes the file, and then executes the command. The problem with this is that these steps are taken for each command line in the procedure, resulting in multiple file open/closes that are not really necessary.

This procedure for reading individual lines from a file is done by using a batch oplock whereby the client can read the data from its local read-ahead cache instead of reopening the file on the remote server to get each line.

Level II oplocks were new with the NT changes to SMB. This kind of lock allows more than one client to have a file opened for reading. When a client must read from a file that is opened by another exclusively, the server informs the current client that its exclusive lock has been broken and is now a Level II oplock. No client that has a Level II oplock will buffer data to or from the file. Thus, after the lock has changed to a Level II oplock (and the first client has flushed any data in its buffers), both clients can continue reading the file.

Protocol Negotiation and Session Setup

SMB has a built-in mechanism that is used by the client and server to determine the other's capabilities so that a common protocol version can be established that the two will use for the network con• nection. The first SMB message that the client sends to the server is one of the SMB_COM_NEGOTIATE type. The client uses this message to send the server a list of the dialects it understands. The server selects the most recent dialect it understands from the client's list and returns a message to it.

The response the server returns depends on the type of client. The information includes the dialect selected and can include additional information, such as buffer sizes, supported access modes, time and date values, and security information. After the client receives this response, it can continue to set up the session by using the SESSION_SETUP_ANDX message type.

If the initial server response indicates that user-level security is being used, this message type can be used to perform a user logon. The client sets a value in the message header called the UID (user ID) for the account it wants to use. It also supplies the account name and password to the server by using this message type. If these values are validated by the server, the user can continue to use the UID to make subsequent accesses.

Other setup functions that are performed by using SESSION_SETUP_ANDX include the following:

• Set the maximum values for the size of buffers that will be used in the message exchange.
• Set the maximum number of client requests that can be outstanding at the server.
• Set the virtual circuit (VC) number.

If the VC passed to the server is zero and the server has other circuits open for the client, it will abort those services, assuming that the client has rebooted without freeing those services first. To properly close a session, the client uses the message type LOGOFF_ANDX, which causes the server to close all files associated with the user's UID.

Accessing Files

Other SMB message types are used to traverse the resource directory and to open, read, write, and close files. First, the user must connect to the resource by using the TREE_CONNECT message. The mes‑

sage includes the name of the resource (server and share name) and, for earlier clients that do not perform logons, a shared password. The server responds by sending the user a value called the TID (Tree ID), which will be used in SMBs exchanged for this connection.

After the connection has been established, several basic SMB command formats can be used to manipulate files and directories that reside on the share. For example, the CREATE_DIRECTORY message is used to create a new directory in the file share's directory structure. The client passes the pathname for the new directory, and the server creates the directory, provided that the client has the appropriate access rights or permissions. The DELETE_DIRECTORY SMB message can be used to remove a directory, again based on the functions allowed for the username.

Opening and Closing Files

The OPEN message is used by a client to open a file. The path for the file is given, relative to the file share root. The client specifies the access that is desired, such as read, write, or share. If the file is successfully opened, the server returns a File ID (FID) to the client, which is used to further access the file using other SMB message types; it is similar to a file handle, which most programmers will recognize.

The server also returns data to the client indicating the actual access that was granted, which is read- only, write-only, or read/write. The CLOSE message is sent by the client to tell the server to release any locks held on the resource fileheld by the client. After this message, the client can no longer use the FID to access the file, but it must instead reopen the file and obtain a new value.

When a client does not know the exact name of a file that it wants to open, the SEARCH message can be used to perform a directory lookup. This function enables wildcards to be used, and the server response can include more than one filename that matches the request.

NFS Client Daemons

On the client side of the NFS process, there are actually three daemon processes that are used. The first is biod, which stands for block input/output daemon. This daemon processes the input/output with the NFS server on behalf of the user process that is making requests of the remote file system. If you use NFS heavily on a client, you can improve performance by starting up more than one bind daemon. The syntax used to start the daemon is as follows:

/etc/biod [number of daemon processes]

This daemon is usually started in the / et cIrc. local startup file. Modify this file if you want to permanently change the number of daemons running on the client system. You can first test by executing the command online to determine how many daemons you need to start and then place the necessary commands in the startup file.

When deciding performance issues, remember that on a heavily loaded client, making a change in one place might result in poorer performance from another part of the system. So don't assume that you need a lot of extra daemons running unless you can first show that they are needed and do improve performance. Each daemon process is like any other process running on the system, and it uses up system resources, especially memory. Begin by using one or two daemons if you are using a workstation dedicated to one user. For a multiple-user computer, test your performance by increasing the number of daemons until NFS performance is satisfactory (all the time checking, of course, other performance indicators to be sure that the overall system impact is justified).

Although having multiple daemons means that NFS requests can be processed in parallel, remember that the network itself might be a bottleneck. Additional biod daemons will not increase throughput when the network itself is the limiting factor.

Also note that the biod daemon is a client process. You should not run it on an NFS server unless that server is also a client of another NFS server.

In addition to the biod daemon, the lock d and st at d daemons also run on the client

The mount Command

The mount command is used to mount a local file system, and you can also use the command to mount a remote NFS file system. The syntax for using mount to make available a file system being exported by an NFS server is as follows:

mount -F nfs -o options machine:filesystem mountpoint

In some versions of Unix, the syntax for mounting a remote NFS file system is a little different. For example, in SCO Unix you use a lowercase f and an uppercase NFS:

mount -f NFS -o options machine:filesystem mountpoint

In BSD Unix, there is a command called mount nf s, which uses the system call mount to perform most of its functions. This version of the mount command comes with a lot of additional parameters, including the capability to specify on the mount command line whether to use UPD or TCP as the underlying transport mechanism.

The value you supply for machine: filesystem should be the hostname of the remote server that is exporting the file system you want to mount for machine. Substitute the name of the file system for filesystem. The following example causes the remote file system on host zira, called /usr/ projectx/docs, to be made accessible in the local file system hierarchy at the /usr /docs directory:

mount -Fnfs -oro zira:usr/projectx/docs /usr/docs

This is the same way you mount other local file systems into the local hierarchy. Under the / us r/docs directory, you can access any other subdirectories that exist on host zira under the /usr/projectx/docs directory.

The -o parameter can be used to specify options for the mount command. In the preceding example, the letters ro for the option were used to make the remote file system read-only by users on the local computer.

Other options that can be used when mounting a remote file system include the following:

• rw—Mounts the file system for local read-write access, which is the default.
• ro—Mounts the file system for local read-only access.
• suid—Allows setuid execution.
• nosuid—Disallows setuid execution.
• timeo=x—Specifies a timeout value (in tenths of a second). The mount command will fail if it cannot mount the remote file system within this time limit.
• retry=x—The mount command will attempt to mount the remote file system x number of times, with each attempt lasting for the length of time specified by the timeo parameter.
• soft—Causes an error to be returned if the mount is unsuccessful. Opposite of the hard option.
• hard—Causes the mount attempt to continue until it succeeds. Opposite of the so^-ft option.

For more command-line parameters and options, see the man page for the mount command for your particular system.

The mountpoint is the path to the location in the local file system where the remote NFS file system will appear, and this path must exist before the mount command is issued. Any files existing in the mountpoint directory will no longer be accessible to users after a remote file system is attached to the directory with the mount command, so do not use just any directory. Note that the files are not lost. They reappear when the remote file system is unmounted.

Using the fstab File to Mount File Systems at Boot Time

When you have file systems that need to be remounted each time the system reboots, you can use the file /etc/fstab to do this. This file is also used to mount local file systems, so be careful when making edits. The format for a record is as follows:

filesystem directoryname type options frequency pass

The filesystem field for a record used to mount a remote file system includes the server hostname and the pathname of the remote file system separated by a colon (hostname: path ). The second field, directoryname, is the path for the mountpoint on the local system, which indicates where the remote system is mounted and made available for access. The next field, type, is used to specify the file- system type, which can be any of the following:

• uf s—A typical local Unix file system.
• mf s—The memory file system.
• nf s—An NFS remote file system.
• swap—A disk partition used for swapping by the virtual memory system.
• msdos—An MS-DOS–compatible file system.
• cd9660—A CD-ROM file system as defined by ISO 9660.
• pr ocf s—A filesystem structure used to access data about processes.
• kernfs—A filesystem structure used to access kernel parameters.

The options field is used for a comma-delimited list of mounting options (rw, ro, and so on). The frequency is used in determining when a file system will be "dumped" for backup purposes. This can usually be set to zero for NFS systems mounted on a client because it is usually the NFS server that is responsible for making backups of local data. The final field, pass, can also be set to zero most of the time for an NFS file system mounted on a client. This field is used by the f sck utility to determine on which pass it is to check this file system.

Microsoft Distributed File System (DFS) continue...

Creating a DFS Root

Creating a DFS tree is not a complicated task when using a graphical interface such as the one provided by the MMC and by the wizards that walk you through setting up your file system. To create a new DFS root, use the following steps:

1. Click Start, Programs (All Programs for Windows Server 2003), Administrative Tools, Distributed File System.
2. When the management console appears, select New Root from the Action menu. A wizard pops up. Click Next.
3. You can select to create a file system that makes use of the Active Directory for storing the DFS configuration information. You can also select to not use the Active Directory. For the purposes of this example, I've chosen to not use the Active Directory. After making the selection, click Next.
4. The next dialog box prompts you to enter the name of the server that will host the distributed file system. The default is usually the server on which you are running the wizard. Use the default or enter another server. Click Next to continue.
5. The wizard next prompts you to enter the name of the new root DFS file system. Note that what you enter here shows up in the field Share to Be Used at the bottom of the dialog box. You can use the name of an existing share in the Root Name field, or create the share to be used after you complete this wizard.

6. If you entered a share that does not yet exist, you can now choose the folder to share by entering it in the field or by using the Browse button.

7. Finally, the wizard displays a summary of the information you have entered. Click the Finish button to complete the process of creating the new DFS root.

Adding Links to the DFS Root

After you've created the initial root for your file system, you can add one or more links. Links, as yo will recall, are actual directories (or folders, depending on which terminology you prefer) that will be accessible from your DFS root.

DFS is a domain-wide file system. You can easily browse a file share located on another server in the domain. Thus, you can hide the physical location of files from users. Instead of having to remember servers and share names, the user only has to remember the share name. Because the share name is domain-wide, you can't use the same share name on one server that you do on another. Users can then simply connect to the share \ \domainname\share. They don't need to know the server names on which the actual folders in this share are located.

You can use the Action menu to add or delete a DFS root. You can also use the Action menu to manage links and replication.

DFS does not add any additional security features to the file system. Instead, the usual rights and permissions that are already in place on the server are used when evaluating a client's access to a file or directory in the DFS tree.

One major difference between NFS and DFS is that DFS is built using SMB messaging techniques for the most part and is not compatible with all NFS servers. If you have a mixed-environment network in which most of your data files are offered via NFS on Unix servers, it would be more economical to acquire PC-based NFS client software than it would be to replace all your existing servers with NT DFS servers.

Microsoft Distributed File System (DFS)

Like NFS, DFS employs a tree structure for file systems. A directory that is being imported by a client is attached at a point somewhere in the local file system, where it is then made available to applications as if the directory and its files were local.

The Windows Server family (both 2000 and 2003 versions) includes DFS as an integral part of the operating system. The interface is written as a snap-in to the Microsoft Management Console (MMC) tool, making administration a simpler process. A wizard prompts you through setting up a DFS root, and from there on out you can add, modify, or remove directory paths from the DFS tree. Paths represented in the DFS tree can come from one or more servers on the network. A tree is not bound by a single host.

In Windows NT 4.0, directory replication allowed you to create copies of directories on multiple systems, keeping them in sync. This functionality was replaced in Windows 2000 Server with Distributed File System (though it is also possible to download DFS for Windows NT 4.0). DFS is now included as a part of modern Windows operating systems. DFS allows you to move away from the \ \server\

sha rename concept to one based on the domain. Instead of having to remember (or browse and find) on which server a particular file share is hosted, you can use DFS to create shares that are global to the domain. That is, if you're a member of the domain, you can specify the share as \ \domainname\ share. DFS also allows for replication. This means that you can have more than one copy of the data being shared, but only have to use the global domain-wide share name to connect. This provides for some fault tolerance. If a server goes down that happens to host a replica of a share, then the other servers that contain copies of the share can be connected to by users. Note that this does not provide any kind of failover if a server crashes. The user can, however, restart her work by reconnecting to the share. The connection will be made to another replica of the file share.

Important terms to understand when dealing with DFS are listed here:

• Root—A server can have only one root installed. It is just about the same thing as a file share, with a few differences, which will become apparent shortly.
• DFS link—Under the root you create DFS links. These are links to file shares that will be available under the root you have created. This means you can create a single root yet place multiple shared directories under the root so that only one file share connection is necessary. If not, users would have to connect to each directory as a separate file share.
• Replica—You can create shares that replicate the data in other shares. This can be done to provide for both load balancing and a degree of fault tolerance.

NetWare Core Protocol (NCP)

NetWare is composed of several protocols. IPX is a connectionless delivery service that can be used by higher-level protocols (such as NCP or SPX) to create a connection-oriented, reliable transport service. Two other important protocols used in NetWare are the Service Advertising Protocol (SAP) and the Routing Information Protocol (RIP). It is through SAP that servers announce their presence periodically and clients can make requests to locate resources. RIP is used to locate servers on the network.

Another protocol, called NetWare Core Protocol (NCP), is used for communications exchange between a client and a server when file reads, file writes, or other file-related activities are being performed. It provides connection control and defines the methods used to encode requests and replies. NCP is a simple request-response protocol, similar to SMB in that respect. NCP requests are encapsulated in IPX packets. The NCP header information, which follows the IPX header information, consists of five fields. The first indicates the request type, which provides the function of the packet.

The client can make a request using four request types in this field, and the server can use this field to indicate a type of reply:

• Create a service connection (1111)
• General service request (2222)
• General service replies (3333)
• Terminate a service (destroy) connection (5555)
• Request burst-mode transfer (7777)
• Request being processed (9999)

These services can be further qualified by function and subfunction codes contained in the request packet. Other fields in the NCP header include the following:

• Sequence Number field, which is used to track the sequencing information for the connection.
• Connection Number Low field, which is a service connection number that is assigned to the client when it logs on to the server.
• Task Number field, which is a value that identifies the client that is making an NCP request.
• Connection Number High field, which is currently not used and should always have the value of 00 hex.

The header information for the response packet that the server sends back to the client will contain these same fields, but it will also add to additional fields. The first is a Completion Code field, which will be set to 0 if the request was successfully completed or to 1 if an error was encountered in processing the request. The Connection Status field might have values indicating an error condition between the client and server connection.

When the client initiates a connection request with a server, it will create a service connection (1111) request type. The server gives the client a connection number in its response. This connection number is used by the client when it submits its remaining requests. Each time a request is sent on the particular connection, the sequence number is incremented. The response to a request contains the same sequence number, making it easy for the client to match up responses to pending requests.

General Requests and Responses

Most of the exchanges between client and server are usually the result of requests made by the client (type 2222) and the replies sent by the server (type 3333). These requests can be used to search directories or to open, read, and write to files.

The server uses the connection ID number and the sequence number when it sends a reply to a request. The Completion Code field is filled in to indicate success or failure, and other data might follow in the packet that is used to fulfill the request (such as data read from the file).

Burst Mode

NCP provides commands that can be used to read and write blocks of information in files that reside on the network. However, when larger files must be transferred, a special NCP request (Request Type value=7777), using burst mode, allows the server to send a larger, single burst of data to the client at one time—much larger than the amount allowed by the regular read and write requests (up to 64K).

Burst mode capabilities can be found on NetWare 3.0 and later servers.

The actual mechanics of burst mode involve more than just sending larger amounts of data in a single operation. The client first performs testing to determine a value that will be used for the Interpacket Gap Time (IPG) and the size of the data request (the burst windows size). The window size might vary during the history of the connection, based on how successful communications are. When data is lost during a transmission, the client can send a request to the server to transmit only fragments of the original data stream, those that were not correctly received.

An error condition such as this causes the window size to be reduced. As communications continue with no problems, the window size gradually increases.

Request Being Processed Response

When a client does not receive a response to a request after a timeout period, it will send in a duplicate request. If the server is heavily loaded, it might send back a request that has a request type value of 9999, which is the Request Being Processed type. This is an indication to the client that the request has been received, but that the server is just too busy to do anything about at it at the time. This reply does not guarantee the client that the request ever will get answered, however. It only lets the client know that it can reset its timer and wait longer if need be.

When the client's timer expires, it can send another request to the server, which might respond to the request or which might send another message telling the client to wait. This response type is used to help reduce congestion in a busy network by reducing the number of requests transmitted on the network.

Terminating Connections

This request type is used to end a connection between the client and the server. The only information needed in this packet, other than the request type (5555), is the sequence number of the request and the connection ID number. The server will respond with a standard response packet (3333) with a completion code of zero to indicate that the connection has been successfully brought to a close.

Using the SMB/CIFS Protocol on Non-Microsoft Clients: Samba

SMB/CIFS is a protocol that is highly entrenched in the Microsoft world of operating systems and networking products. It makes sense, then, that there would be a way in which these workstations and servers could be integrated into a Unix/Linux environment without a lot of difficulty. The answer to this problem is called Samba, which is a set of products that provide for SMB conversations between SMB servers, such as Microsoft Windows operating systems, and those that do not use it natively,such as many different variants of Unix or Linux systems. In addition, Samba has been ported to several other popular operating systems, including OpenVMS.

Samba was originally developed by Andrew Tridgell and is now maintained by him and other developers (the "Samba Team") on the Internet.

From this Web site you can choose a mirror Web site for your country, and then you can view the documentation for Samba and download the most recent version. The software is freely distributed under the GNU public license.

You can configure Samba servers on your Unix boxes to enable high-performance machines to beused as file servers on the Windows network. You can still manage the servers using Unix file administration procedures, and yet to the client computers, the shares appear no different than those offered by other Windows-based file servers.

Troubleshooting a Samba server can be made easier by starting the Samba server software using the - d parameter to specify a debug level (from 1 to 100), which will cause more output messages, depending on the level you specify.

You can also use a LAN analyzer to view the sequence of exchange of SMB messages between server and client. Available as a download from the Samba home page is an extension to the tcpdump utility, called tcpdump-smb. You can use this to capture smb packets and decode the header information.

The Common Internet File System (CIFS)

CIFS is intended to be a replacement, or an upgrade, of the SMB protocol. Design considerations include making it platform-independent. While SMB resides in the NetBIOS legacy environment, CIFS runs on top of TCP. Other improvements over SMB include the following:

• Unicode filenames are used. Because the Internet is global, it's helpful to be able to encode char acters that support multiple languages.
• Service is automatically restored after a network disruption.
• CIFS is not proprietary to Microsoft. It is an Open Group standard (X/Open CAE Specification C209). It has also been proposed as an Internet standard to the Internet Engineering Task Force (IETF). This is an improvement over the earlier SMB protocol.
• DNS is used to translate between computer hostnames and IP addresses.
• Both share-level authentication and user-level authentication are supported. With user-level authentication, the user must be authenticated (using a username/password valid on the server) before access is granted.
• CIFS has been optimized to make communications across a slow link—such as a dial-up modem—possible.
• CIFS is basically an enhanced version of SMB and still uses server message block messaging. Better security and the use of DNS are necessary additions if the protocol is to be used on the Internet.

What is the Difference Between IPv4 and IPv6? continue...

IPv6 Extension Headers

In general, most protocols have header information followed by a payload that contains the actual data to be transmitted from one point to another. Some protocols include a trailer that usually is use to provide some type of integrity check, such as CRC, to ensure that the frame or datagram has arrived at the destination without corruption.

Still other protocols, and we're talking about IPv6 here, allow for additional headers to follow the ini tial IPv6 header, to describe certain aspects of the datagram. These headers are not required, but one or more can be placed into the datagram. These additional extension headers are placed directly after the IPv6 header, where the payload section is usually located. The payload that follows the lPv6 header, or the extension headers, will be a header for the encapsulated upper-layer protocol being transported by the IPv6 datagram. It is interesting to note that among the following headers, if the hop-by-hop header is used, it must follow the IPv6 header as the first additional header. Other extension headers don't have to be in any particular order, but the RFCs do suggest that certain headers be placed in a certain order.

The field Next Header is used to indicate whether another header follows the current header, after the initial IPv6 header. Yet if the next header is not one that the receiving node recognizes, the node should discard the datagram and send an ICMP message to the source indicating that there was a problem with the packet. In IPv6, the ICMP code for this is 1, which in text format means "unrecognized Next Header Field Header type encountered." This ICMP message is used in many of the IPv6 procedures.

It is important to note that an IPv6 datagram doesn't have to have any extension headers. They are used only when the feature is implemented in the IPv6 hardware (or software) routing mechanism.

The extension headers that can follow the IPv6 header include these:

• Hop-by-Hop—If present, this is the only header that must be examined by every node (read that as router, whether an actual router device or a computer acting as a router). This header, as described previously, must be placed directly after the IPv6 header. If you look back at the Next Header field of the IPv6 header shown in Figure 35.1, a value of zero indicates that the Hop-byHop header is the next header, and must be examined. The IPv6 header is the only header that can use a value of zero in the Next Header field. If any other extension header contains this value, an ICMP message value of 1 will be sent back to the source. This value indicates "unrecognized Next Header type encountered." This option type can be of variable length.
• Destination Options—This header can also be of variable length, and is used only by the destination of the packet. This extension header is used to carry additional information, which is to be defined by other RFCs.
• Routing—This field specifies specific network nodes that a packet should be passed through (a route) to reach its destination. Routers usually decide the route a packet will take depending on the routing protocol. Using this option, IPv6 routers can specify a route. The nodes listed in this option are not guaranteed, however, because there is always the possibility that a particular node might not be online. Or the Maximum Transmission Unit (MTU) of a router listed here might not accept the size of the packet, and thus the packet can't be sent through that router.
• Fragment—This option enables the source node to fragment a packet so that it will be able to reach its destination based on the MTU of the routers between the source and the destination. However, because this value is set by the source node, and it cannot be certain of the MTU value of intervening nodes, packets can still be dropped. A field called the M flag field can be set to one if more fragments of the original message are to be sent, or zero if the packet contains the last fragment of the original message. An Identification field is used to identify which fragmented packets should be considered as a group to be reassembled at the destination node. At the destination, fragments are identified by the source address + destination address + Identification field.
• Authentication
• Encapsulating Security Payloadis
• Upper-layer header—This header follows the other headers, as in an IPv4 packet, and describes the data contained in the remainder of the payload section of the packet.

The preceding list is described in the recommended order suggested by the RFC. This can change depending on a few circumstances. For example, if the Destination Options header should be read n just by the node specified by the destination address found in the initial IPv6 header, but also by th other destinations listed in the Routing header, then the Destination Options header should be p1 immediately after the Hop-by-Hop header, followed by the Routing header.

The Options Type Field for Hop-by-Hop and Destination Options

If the Destination Options header should be examined only by the final destination node, it should be placed just before the upper-layer header. The Options Type field for Hop-by-Hop and Destination Options is an 8-bit field. However, it should be interpreted by bit values, not by byte values.

The third-highest-ordered bit used is either zero or one. If the bit has a value of zero, the data contained in the option cannot be changed by a node it passes through on the way to its eventual destination. If the bit has a value of one, a node can change data in the extension header.

The Next Header field is used by all options. It simply specifies what the next option (following the current option) will be. These option type numbers are based on those described for IPv4. These numbers were originally defined in RFC 1700, and later RFCs. However, the RFC process was not sufficient to keep up with newer protocols and services that were being developed, so an online database now exists. You can use this database to determine what type of protocol or option the Next Header field indicates.

Other IPv6 Considerations

Although IPv6 contains a field that defines the maximum number of hops (the Hop-to-Hop field), it is not required that all nodes support this function, though they can if desired. Instead, upper-layer protocols (such as TCP) are generally delegated this responsibility.

In addition, upper-level protocols should be aware that the maximum payload space has been reduced if IPv6 headers are to be added to the packet. Again, this is a modification that will require that upper-layer protocols be modified, or that the source use fragmentation to deliver packets to their destination.

The Future of IPv6

IPv4 has been in use for more than 10 years now, and although most of the address-space issues have been resolved, there will come a time when the usefulness and flexibility of IPv6 becomes more and more important. There are many enhancements to IPv6 that might warrant its implementation in your network. If your network hasn't yet adopted IPv6, you can bet that eventually it will.

What is the Difference Between IPv4 and IPv6?

The IP protocol is a connectionless, unreliable protocol. TCP uses IP to establish sessions with remote computers and provides the reliability of the data transactions. IP, however, provides the hierarchical address space used by IPv4. Yet this address space is limited to fields in the IP datagram that are only 32 bits in length. When first created, it seemed like this address space would provide enough IP addresses to last for decades or more. After all, only government, educational facilities, and a few other institutions used what was then the ARPANET (the predecessor of the Internet). The address classes' original part of the IPv4 address space has pretty much been displaced by CIDR, to prevent wasting large ranges of addresses allocated to a single entity (such as class A networks).

IPv6 increases this 32-bit address space to 128 bits. At first glance, 32 bits versus 128 bits doesn't seem to be a big difference. When you consider the number of possible addresses that each of these bit ranges can provide, however, there is a tremendous difference. Fill a 32-bit field with all ones and you end up with a number just over 4 billion. A 128-bit field can provide a much larger number of possible addresses. The actual number of addresses, of course, depends on which bits are used to identify a network and which are used to identify a host on a network.

The address space that IPv4 enables can give us enough addresses to satisfy the demand today, especially when using NAT for LANs and using CIDR to reclaim wasted address space that was created by the original address classes. Yet the world of electronics today has changed the playing field. It's not just computers that need an IP address. Handheld devices, mobile phones, and other consumerdevices will likely require an IP address in the near future. NAT might work well in a LAN or a small enterprise network, but when you consider that many wireless devices will roam from one provider to another, an assigned IP address becomes more important. NAT is performed at a local level, not a national or global one.

Expanding the IP address space is not the only feature that IPv6 gives to the Internet and your LAN or WAN. Other important features include the following:

• A simpler header format for the IP datagram, which makes it possible to create faster routing techniques implemented in hardware designs.
• Support for new extensions to the IP header, as well as a means to include future expansion for additional headers that may be created later.
• The replacement of certain options left over from the IPv4 specification, as well as new options, and, again, room for expansion of additional options as required in the future.
• The capability to specify which datagrams require special handling when it comes to flow control. This capability can enable real-time handling of a stream of IP datagrams (needed, for example, for real-time voice or video communication over an IP network), a feature usually accomplished by other protocols tunneling IP.
• Authentication and encryption capabilities to provide for a secure connection.
• As you can see, there are many differences between the capabilities of IPv4 and those of IPv6.

The IPv6 Headers

Headers are used by protocols to provide information about source and destination addresses, protocols, or the payload encapsulated by the datagram. It is typical that one protocol's packet is sent as the payload of another protocol. For example, the IP datagram is usually sent across most LANs encapsulated in an Ethernet frame. At the destination, the Ethernet portion of the frame is stripped off and the IP packet information is

revealed. The IP information is then removed by the protocol stack, and the TCP (or other protocol) information is then removed before the actual data is reassembled and sent to an application.

A few of the IPv4 fields were never put to any practical use. And some of those fields no longer existin the IPv6 header.

The fields for IPv6 are as listed here:

• Version—This 4-bit field is the version of the Internet Protocol. The value for IPv4 was 4. The version for IPv6 in this field is 6. Routers and other devices use this value to determine what type of datagram is being processed.
• Traffic Class—Similar to the Flow Label field, this field enables nodes to specify a particular "traffic class," the definition of which is still being defined by many RFC documents. This field should be supported by any intervening device (such as a router) that understands this field (as it exists today), and ignored by those that do not.
• Flow Label—This 20-bit field is used to request that devices that stand between the source and the destination give special preference to this datagram. This can be compared to the Quality of Service field of IPv4 headers
• Payload Length—This 16-bit field is used to indicate the length of the payload section of the datagram. This does not include the original header of the IP datagram, but it does include any additional headers, as well as the actual payload of the datagram.
• Next Header—One of the most useful features that IPv6 provides is that additional headers can be included in a datagram, in addition to the main IPv6 header itself. There are many typ of headers, and they can be useful depending on the type of payload, or the treatment of the current datagram (such as routing techniques).
• Hop Limit—This 8-bit field is similar to a Time to Live (TTL) field used by many other pro cols. It is decremented by 1 at each router the datagram passes through. When the value reaches 0, the datagram can be discarded.
• Source Address—A 128-bit address used to describe the IP source of the datagram.
• Destination Address—A 128-bit address used to describe the IP destination address of the datagram.

This section describes just the initial IPv6 header format. In the next section you will learn about ho IPv6 can include additional headers that extend the traditional header to provide information about additional services for the IP protocol.

Windows NT Passwords and Policies

Windows NT enables the administrator to set certain parameters that control passwords and accounts. This is called the account policy for the domain. To view the defaults or make changes, select Account from the Policies menu in the User Manager for Domains utility.

The values you choose for these parameters should reflect the degree of security you want to enforce at your site. At the same time, you need to balance your concerns with the abilities of your users. For example, if you set a large minimum password size and a low value for the number of days it can be used, users might end up writing down passwords just to keep track of them.

These are the parameters you can configure here:

• Minimum Password Age and Maximum Password Age—The Minimum Password Age specifies the number of days that must elapse before a user is allowed to change a password. The Maximum Password Age is the number of days that a password can be used, after which the system will force the user to change it. Both of these parameters can be set to a value ranging from 1 to 999 days.

• Minimum Password Length—This is the minimum number of characters that must be used for a password. Too small a value will make it easy for hacker programs to guess a password. Too large a value will make it difficult for users to think up new passwords. This parameter can be set to a value ranging from 1 to 14, or you can permit a blank password (no password), although it is hard to imagine a network where you might want to allow, as a policy for every user in the domain, a blank password.

• Password Uniqueness—The system will keep a history list of passwords used by each user and will not allow them to reset their password to one that is still in the list. This prevents users from constantly reusing a few easy-to-remember passwords, which can be bad for security purposes. Set this parameter to a value from 1 to 24. Selecting not to keep a history list is probably not a good idea because many users will take advantage of this option, and eventually someone else will find out what their usual password is.

• Account Lockout—You can set up the system so that a user account is "locked out" after a number of failed login attempts. This can be used to prevent an unauthorized user from trying to guess a password for an account, as is done in the brute-force method by many hacker programs that simply go through a dictionary, trying every word until they crack an account. If you set a value for bad logon attempts, you also can use the Reset Count After field to a time value (in minutes). This field specifies the period of time during which the failed logon attempts are counted. The Lockout Duration fields can be used to permanently lock the account until an administrator intervenes, or to set a time in minutes that the account will be disabled. A good idea is to set a small value for the Lockout After parameter (3 to 5 is a good choice), while using a long lockout value. Thirty minutes to an hour will usually suffice to deter unauthorized users.

At the bottom of this dialog box, you can see two other check boxes. The Forcibly Disconnect Remote Users check box must be checked in order for the user to be disconnected from the server when he stays logged on past the authorized period specified in the Hours button of the user's Account Properties dialog box. If the second check box, User Must Log On in Order to Change Password, is checked, users will not be able to log on after their password expires and change it. The administrator will have to perform this function instead. If this box is not checked, after a user password expires the user still will be allowed to log on but will be required to change the password before performing any other function.

Detecting Failed Logon Attempts

User logon failures occur for many reasons. The most common reason is that users forget passwords or type them incorrectly enough times to trigger the account lockout mechanism. Because Windows NT allows you to create a single username and password logon for each user, the problem of multiple passwords is usually not a problem as it is some other networks.

The Windows NT Event Viewer utility, found in the Administrative Tools section along with the User Manager for Domains, can be used to check for failed logon attempts. This is the first place you should look when a user is having problems logging on to the domain or connecting to a resource on a remote server. The user might not be providing the correct password or might be trying a username for which there is no account. The Event Viewer keeps three log files: Application, System, and Security. It is in the Security log file that you will find messages that relate to logon attempts.

As you can see, successful logon and logout events can be tracked. These types of messages can be useful when you are trying to determine who was on the system, perhaps during off hours, when you are trying to troubleshoot security problems. The other messages can be helpful in quickly identifying what the problem is when a user cannot log on to a server or connect to a resource.

The security log file you can examine using the Event Viewer can be configured to track all successful and unsuccessful logon attempts. This includes users who log on locally at the computer, connections made through network access, and logons by special accounts that you set up to run services.

Windows NT does not automatically track events such as these. You must enable the types of events you want to audit before they will be recorded in the security log file.

Strategies to Minimize Logon Problems

The best way to solve a problem is to take all necessary measures to ensure that the problem doesn't happen in the first place. Although it is not possible to completely eliminate every source of failed logon problems, you can do a lot to keep your network users happy by taking a few precautions:

• Place a backup domain controller on every physical subnet—If a network link goes down, users can still be validated by the local BDC and continue to work with resources to which they can still connect. A BDC with enough available resources can simultaneously perform the same functions as any other Windows NT Server, so if you have a server on a subnet that is offering resources and it is not already overloaded, consider replacing it with a BDC and let it serve two roles. Remember, if the server is not already a domain controller, you will have to re-install the OS and select that option during setup.

• Enforce reasonable password policies—Some operating systems allow you to computer- generate random passwords that are very difficult to remember. If a user cannot remember a password, most of the time the user will just write it down somewhere, which can compromise security. If you force users to change passwords too frequently, they will most likely have a hard time remembering what the recent password is, unless they write it down somewhere. If you set the account policy lockout values too low, you will find that users get locked out because of simple typing errors, and the help desk will spend a lot of time unlocking these accounts.

• Keep track of user accounts—You can use a paper method or an electronic one such as a spreadsheet or database. Delete accounts for users who leave the company and create new ones for new employees. Getting rid of the dead wood will help avoid confusion when troubleshooting and will help keep the SAM databases down to a reasonable size.

• Never use generic accounts where more than one user logs in under the same username—Though this is a tempting idea because you have fewer user accounts to manage, it can be a security nightmare if something goes wrong and you are unable to use auditing measures to figure out the who, what, and when of the matter. Also, when more than one person is using the same account to log on, it takes only one person with fumble-fingers to incorrectly type a password a few times and lock an account, also preventing others who use the same account from logging in.

To fully understand how to troubleshoot problems with logons, you should make yourself knowledgeable about the Windows NT Event Viewer administrative tool.

Windows 2000 User Groups continue…

Built-In Groups

There are several kinds of built-in groups, depending on where you look in the directory structure. The domain local scope built-in groups can include the following:

• Account Operators—Users placed into this group can perform account management duties, such as creating new users.

• Administrators—This is the most powerful group. Members of this group can do just about anything they want in the domain, including taking ownership of files and creating user accounts.

• Backup Operators—Members of this group get the access rights needed to perform backups on computers in the domain.

• Guests—A guest group, which can be used to grant very limited access to users from other domains.

• Incoming Forest Trust Builders—Users in this group can create incoming trust relationships from other forests. Keep in mind that trust relations in the Active Directory are transitive but must be established manually between Active Directory trees in the forest.

• Network Configuration Operators—This group allows users to manage some aspects of network configuration.

• Performance Log Users—Members of this group can schedule logging of performance monitors on this computer, from a remote computer.

• Performance Monitor Users—This user group can monitor performance on this computer from a remote computer.

• Pre-Windows 2000 Compatible Access—This group is meant for pre-Windows 2000 users to enable them to have read access for users and groups in the domain stored in the Active Directory.

• Print Operators—Youguessed it: Members of this group can control printers and print jobs.

• Remote Desktop Users—Users in this group can log in to this computer from a remote computer.

• Replicator—Used by services responsible for replication.

• Server Operators—Members of this group can perform tasks on specific servers.

• Users—A built-in group for ordinary users in the domain, which can run applications, but not make systemwide configuration changes.

In addition to these built-in groups, you can click on the Users folder and see a list of predefined groups, which also can be used to organize users. These are global scope groups, so you can use them to organize users and computers, and then place them in domain scope groups in the current domain or in other domains. If none of the following group names fits your needs, you can create your own groups, which we'll look at next.

The Predefined groups found in the Users folder are listed here:

• Cert Publishers—Users can publish certificates to the Active Directory.
• DHCP Administrator—Members can administer the DHCP service.
• DHCP Users—Members of this group have view-only access to the DHCP service.
• DnsAdmins—The DNS Administrators group who can manage the DNS service.
• DnsUpdateProxy—This group allows members to update the Domain Name System (DNS) service for other clients, such as a DHCP server.
• Domain Admins—Users who administer the domain.
• Domain Computers—All workstations and servers joined to the domain.
• Domain Controllers—Every domain controller in this domain is a member of this group.
• Domain Guests—Members are guests in the domain, with limited access.
• Domain Users—All members of the domain.
• Enterprise Admins—Members can administer the entire enterprise.
• Group Policy Creator Owners—These users can modify the group policy for a domain.
• HelpServicesGroup—Users that provide help via the Help and Support Center.
• IIS_WPG—Members who manage the Internet Information Server.
• PasswordPropDeny—Members of this group should not have their password synchronized.
• RAS and LAS Servers—Servers that are members of this group can access the remote access properties of users.
• Schema Admins—Administrators of the Active Directory schema.
• Terminal Server Computers—Computers that can communicate with the Terminal Services License server.
• WINS Users—Members of this group have view-only access to the WINS server.

In general, the groups you'll use most in the list will probably be the Domain Computers and Domain Users groups. By default, when you create a user account, the new account is placed automatically into the Domain Users group. Likewise, when you add a computer to the domain, the computer is automatically placed into the Domain Computers group. Looking at the domain from an overall picture, you can use these two groups when you want to make changes that apply to all users or all computers in a domain. The Domain Admins group can be used to give selected individuals administrator-level rights in a domain. It is always a good idea to not use the actual built-in Administrator account for a domain. Instead, create individual accounts for each user, and then place the user into one or more groups that give him the access he needs. If you need to grant a user administrator-level rights, just place him into the Domain Admins groups.

The other groups will depend on the services you have installed. Some may not appear if you have not installed that service (such as DHCP).

A few notes about these predefined groups in the Users folder:

The Domain Users group is a member of the domain's Users group (the one located in the Builtin folder).

The Domain Admins group is automatically a member of the Administrator's group in the Builtin folder.

The Domain Guests group is automatically placed into the Guests group in the Builtin folder.

Windows 2000 User Groups

You need to understand several concepts about user groups in Windows 2000/.NET before you begin to create them. Groups are helpful because they simplify administrative tasks when you have groups of users that must be treated similarly when it comes to rights and permissions. Second, because groups can be limited in scope, they can be useful for security purposes, limiting the computers or domains in which a user can be granted access.

Choosing a Group Based on the Group's Scope

Groups each have a scope, which is basically the area of the domain or global forest that the group covers. By having several types of groups, each with its own particular kind of membership and scope, you can put together combinations that should solve most of your administrative needs for managing users with similar needs. The types of groups, and the scope implied by each, are as listed here:

• Domain local group—These groups are limited to just the domain in which they are created. Users can be placed into these groups for local domain management purposes.

• Global group—These groups are made up of users or groups from a single domain but are used to grant access for the members of the group in other trusted domains. Think of this as a way to "export" users to allow them access to resources in other domains.

• Universal group—This type of group can contain user accounts and global group accounts from any trusted domain that exists in the Active Directory forest. This is similar to a global group but allows members of the group to be granted permission to resources in domains throughout the entire forest.

As described previously, groups can be members of other groups just like users, and this is where things can become a little complicated. For example, a domain local scope group can have the following as members:

• Groups that have global scope—You place the global group into a local group and then manage the local group when granting rights and permissions.

• Groups that have universal scope—Again, you can place universal scope groups into a local group and then use the local group for management purposes.

• Groups with domain local scope—Other domain local scope groups can be placed in a domain local scope group.

• User accounts—You can put individual users into a group with domain local scope.

Note that the domain local group does not have to have just one of the preceding groups (or users) as its members. You can combine any of the preceding and place them into a single domain local scope group, and then use the group to manage the members of these other groups locally in your domain.

A domain local group is a very useful management tool. For example, if you have a particular resource that several users share, place the users in the group and grant the group the necessary access to the resource. The resource can be a folder or a file, or perhaps a printer. If the resource changes in the future (for example, you decide to use a new file server for a particular set of files), you have to

change permissions only on the group to let the group members access the new resource. Otherwise, you'd have to modify the permissions for each individual user, which in a large environment can be an almost impossible task if your network changes frequently.

Unlike domain local groups, global groups can have as members only users or other groups from within a single domain. Yet global groups can be granted access to resources in other trusted domains. This enables you to package a group of users that need similar treatment in other domains when it comes to resource permissions.

Universal groups also can be used to grant permissions in multiple domains—throughout the forest of domain trees. Note that these groups are available only if you have an Active Directory structure that is part of a multidomain forest. They serve no purpose in a single-domain tree because domain local groups and global groups provide the necessary functions in a single-domain tree.

The membership of a universal group should not change on a frequent basis. This is because when a universal scope group's membership changes, the entire list of members is replicated to every global catalog in the forest of trees. Use universal groups for grouping users and other groups that are more stable in membership. Although global groups enable you to create groups of users and other groups that can be granted access in trusted domains, their membership must come from a single domain. To make managing a universal group easier, first place users into global groups in their own domains,and then place these global groups into a universal group. Thus, when the membership of a global group changes, there is no need to replicate the universal group membership to every other global catalog. Only the global group has changed. The universal group has as its member the global group, not the individual users who come and go from the global group.

Using a Shadow Password File of Unix and Linux

To plug the password security hole presented by the / etc / passwd file, a technique called a shadow password file is usually used. This file contains the actual passwords, also in encrypted format. However, the shadow password file is not world-readable, and permissions are set so that only the root account can access this file.

On many systems, the name of the shadow password file is /etc/shadow. Check your documentation to determine the exact path on your system. Also note that on some older systems (and a few current ones), you'll have to load an extra component to install the shadow password file capabilities. Keep up-to-date by consulting your vendor's Web site.

The contents of this file also can vary from one system to another. However, the following format contains the fields used in most implementations:

username:password:last:may:must:warn:expire:disable:reserved

The following list describes these fields:

• username—This field is used for the same purpose as it is in the /etc/ pa s swd file. It is the login name for this user's account.

• password—The user account password stored in encrypted format.

• last—The number of days, since January 1, 1970, that the password for this account was changed.

• may—The number of days that must pass before the password for this account can be changed.

• must—The number of days after which the password for this account must be changed.

• warn—The number of days before the password expires to warn the user about the upcoming password expiration.

• expire—The number of days that must pass before the account password expires and the account becomes disabled.

• disable—The number of days, since January 1, 1970, that the account has been disabled.

• reserved—This field is reserved for future use.

As you can see, using a shadow password file gives you additional control over accounts, such as setting password expiration values. It also gives you informational fields (such as last and disable that can be used when managing user accounts.

The /etc/groups File

This file contains a list of user groups and a numerical value used to identify the group. The syntax for entries in this file is as follows:

groupname:grouppassword:groupID:username1,username2

• groupname—A name associated with the group. Using a meaningful name can help you simplify user administration.

• grouppassword—Yes, you can place a password on a group, but this is generally not done. Instead, this field is usually left blank.

• groupID—This is the group's ID number, which is used by the operating system to identify the group. It is often referred to as the GID. This number can range from 0 to 32,767, and the numbers 0 to 10 are generally reserved for system groups. For example, in most Unix implementations, the root user has a GID of zero.

• usernamel,username2 . . . —This is a comma-delimited list of members of the group. Separate each using a comma.

Users can be members of more than one group. If this is the case, the first group is the user's primary group, and the GID of this group is used when files are created or saved. Users can use the groups command to view the group(s) of which they are a member. The command chgrp can be used to change the current default group.

Internet Printing Protocol (IPP) continue…

IPP Object Types

In the first version of this protocol, two basic object types are defined: printer and print job. The printer object encompasses the functions that are accomplished by the actual physical printer, rendering the printed page, as well as some of the functions that are traditionally performed by the print server, such as spooling the print file and handling scheduling procedures. The functions of the printer object can be implemented in a print server or on the printer itself. The printer object can be used to send output to a single physical printer or to more than one device.

When a user sends a document to a printer, the printer object creates a new object called a print job. The print job object contains the document to be printed and can contain more than one document per job. The printer object manipulates the print job and handles how it is sent to the physical printer..

IPP Operations

The protocol defines several operations, which consist of a request and a response. The operationallows the client to communicate with the object.

These are the operations defined in the first version of the protocol that can be used with the printerobject:

• Print Job
• Print-URI
• Validate Job
• Create-Job
• Get-Printer-Attributes
• Get-Jobs

The operations that can be used with the print job object are as defined here:

• Send-Document
• Send-URI
• Cancel-Job
• Get-Job-Attributes

A client submits a document to print by using the Print-Job request. Using this operation, the client "pushes" or sends the text to be printed. A client also can submit a job using the Print-URI operation, in which the client sends only the URI reference for the data to be printed and the printer object "pulls" the data itself. To send multiple documents to be printed, the client uses the Create-Job operation followed by multiple Send-Document or Send-URI operations, which also operate in a push-pull fashion.

The printer object responds to Validate-Job requests from the client depending on the current state of the printing job (pending, processing, and so on). For example, the printer object might return a message to the client indicating that the URI is no longer valid. Or the printer object might return error messages to the client.

Other operations are fairly self-explanatory. The Get-Printer-Attributes and Get-Job-Attributes operations return information about the printer or the print job. The Get-Jobs operation allows the client to get a list of job objects that are being processed by the particular Printer object. The Cancel-Job operation is used by the client to remove a job from the Printer object, basically just stopping a job from printing.

The RFCs also go into detail describing the attributes of each object, some of which are required and some of which are optional. These attributes include information about the job, such as its name, time stamps for different parts of the printing process, and the output device assigned to print the job. Attributes for the printer object include the name of the printer, its location, the location of the printer driver for the printer, and other information, such as the make and model of the printer.

What's New in Version 1.1?

Version 1.1 of IPP has added more functionality to the protocol. Several new operations have been defined:

• Pause-Printer
• Resume-Printer
• Purge-Printer

In addition, Version 1.1 suggests the order in which steps should be taken by an IPP 1.1 implementation. In general, these are as listed here:

1. Validate the protocol version.
2. Validate the requested operation.
3. Validate the presence of operation attributes.
4. Validate the values of operation attributes.
5. Validate the attribute values against the object's supported values.
6. Validate any optional operation attributes.

For each request or response, the protocol version number must be included. This value and its semantics are kept in the same place in the packet for future versions to provide for backward compatibility. Next, the operation identifier must be validated against the printer object's operations-supported attribute. The presence of operation attributes and their values are then evaluated, followed by the validation of optional attributes.

If the IPP object receives from a client a request message that is missing a required attribute, or the attribute groups are presented out of order, the object rejects the request.

The IPP protocol has already been widely adopted by major operating vendors, such as Microsoft and Novell NetWare. It will solve a lot of problems for both end users and vendors of printing equipment. Many companies are beginning to use the Internet to create virtual private networks (VPNs) instead of creating WANs using leased lines and other dedicated links. As the Internet continues to weave itself into every nook and cranny of the modern business world, standards such as IPP will generate new types of services. It is easy to foresee a business segment that will take over handling some, or all, of the aspects of printing for a large organization. Standards such as IPP will make implementation of these sorts of services much easier because it won't rely on multiple proprietary protocols and skill sets.

In addition to helping you manage printing across your own private network, IPP might provide some promising business opportunities for those who are clever enough to take advantage of them. For example, using IPP, you could set up a printer to allow your clients to send purchase orders and other documents straight to your desktop. Or you could use IPP to "publish" your product sales literature, catalogs, and documentation, directly to a customer's printer.

Where Can You Find IPP?

A large number of vendors have adopted the IPP protocol, most notably Windows 2000 (Server and Workstation), Windows 2003 and XP Professional, and NetWare 6.x (iPrint). You can submit a job to a printer on the Internet by specifying the URL for the printer.