NetWare includes a feature called NCP Packet Signature that protects servers and clients using the NetWare Core ProtocolTM (NCPTM) services.
NCP Packet Signature prevents packet forgery by requiring the server and the client to sign each NCP packet. The packet signature changes with every packet.
Without NCP Packet Signature installed, a user could pose as a more privileged user and send a forged NCP request to a NetWare server. By forging the proper NCP request packet, an intruder could gain the Supervisor right to the Server object and access to all network resources.
NCP packets with incorrect signatures are discarded without breaking the client's connection with the server. However, an alert message about the invalid packet is sent to the error log, the affected client, and the server console. The alert message contains the login name and the station address of the affected client.
If NCP Packet Signature is installed on the server and all of its workstations, it is virtually impossible to forge a valid NCP packet.
For additional information about packet signature, see the following:
To implement packet signature, see Implementing NCP Packet Signature.
We recommend using NCP Packet Signatures for security risks such as the following:
NCP Packet Signature is not necessary for every server installation. You might choose not to use NCP Packet Signature if you can tolerate security risks in situations such as the following:
Because the packet signature process consumes CPU resources and slows performance both for the client and the NetWare server, NCP Packet Signature is optional.
Several signature options are available, ranging from never signing NCP packets to always signing NCP packets. NetWare servers and Novell clients each have four settable signature levels.
The signature options for servers and clients combine to determine the level of NCP Packet Signature on the network.
You can choose the packet signature level that best meets both your system performance needs and network security requirements.
NOTE: Some combinations of server and client packet signature levels can slow performance. However, low-CPU-demand systems might not show any performance degradation.
The NCP Packet Signature levels for the server and the client interact to create the effective packet signature for the network. Some combinations of server and client levels do not allow logging in.
The following figure shows the interactive relationship between the server packet signature levels and the client signature levels.
The default NCP Packet Signature level is 1 for clients and 1 for servers. In general, this setting provides the most flexibility while still offering protection from forged packets. Following are some examples of situations requiring different signature levels.
For information on implementing NCP Packet Signature, see Implementing NCP Packet Signature.
To implement NCP Packet Signature, complete the following procedures:
SET NCP Packet Signature Option
SET NCP Packet Signature Option = number
Replace number with 0, 1, 2, or 3. The default is 1. For example: SET NCP Packet Signature Option = 2
To ensure that the signature level is set each time the server is brought up, you can add this SET parameter command to your STARTUP.NCF file
You can also use the SET parameter command to change the signature level from a lower to a higher level or use NetWare Remote Manager.
You cannot change from a higher to a lower level unless you first reboot the server. For example, if the current signature level is 2, you can't set the signature level to 1 by using the SET command at the console. To change the signature level from 2 to 1, you must add the SET command to the STARTUP.NCF file and then restart the server:
Set client signature levels to 0, 1, 2, or 3. The default is 1. Increasing the value increases security, but decreases performance.
To set DOS or MS Windows client signature levels, add the following parameter to the workstation's NET.CFG file:
signature level = number
To set the Windows 95 or Windows NT client signature level for an individual workstation, change the parameter setting with the Advanced Settings tab of Novell NetWare Client Properties, as follows:
From the system tray, right-click N.
Click Novell Client Properties > Advanced Settings.
Select Signature Level from the scrollable list.
You can set the signature level for multiple clients at once by adding the signature level to the configuration file when you install the clients. For information about configuring Windows clients, see the Novell Client online documentation.
NLM programs that use the Novell Runtime Libraries are assigned a default NCP Packet Signature level that corresponds to the current signature level of the server.
To change the packet signature level for a single NLM, use the following command syntax when you load the NLM:
[LOAD] NLM [CLIB_OPT]/L number
Replace number with 0, 1, 2, or 3.
A job server is a server that performs a task and then returns the completed task. Most job servers are third-party products.
You should be aware that some job servers do not support NCP Packet Signature. A job server might produce unsigned sessions if one of the following occurs:
To minimize security risks associated with job servers, do the following:
To prevent a job server from assuming the rights of a client, add the following SET command to the server's STARTUP.NCF file:
SET Allow Change to Client Rights = OFF
The default is On, because certain job servers and third-party applications cannot function without changing to client rights. To determine whether the job server can function without client rights, refer to the documentation that comes with the job server.