HP UX Internet and Networking Software manual Improving Security, How NCP Packet Signature Works

Optimizing the NetWare Client Software

Improving Security

Improving Security

You can increase the security of your network by using the NCP packet signature feature available in NetWare 4 and 3.12.

The following sections provide you with information and procedures for setting a parameter used in the client workstation configuration (NET.CFG) file and the SET command used at each NetWare server.

Using NCP Packet Signature to Improve Security

NCP packet signature is an enhanced security feature that protects servers and client workstations using the NetWare Core Protocol™ architecture by preventing packet forgery.

The NCP packet signature is optional because the packet signature process consumes CPU resources and slows performance, both for the client workstation and the NetWare server.

Without the NCP packet signature installed, a knowledgeable network operator can manipulate the client workstation software to send a forged NCP request to a NetWare server. By forging the proper NCP request packet, an intruder can gain rights to access all network resources.

How NCP Packet Signature Works

NCP packet signature prevents forgery by requiring the server and the client workstation to “sign” each NCP packet, using the RSA public and private key encryption. The packet signature changes with every packet.

NCP packets with incorrect signatures are discarded without breaking the client workstation’s connection with the server. However, an alert message about the source of the invalid packet is sent to the error log, the affected client workstation, and the NetWare server console.

If NCP packet signature is installed on the server and all of the network client workstations, it is virtually impossible to forge an NCP packet that would appear valid.

1-8