Now that you understand what it means to have security in a mixed environment, how do you go about achieving it?

Mix It Up: Security in a NT/Unix Enterprise, Part 2

Now that you understand what it means to have security in a mixed environment, how do you go about achieving it?

• By Roberta Bragg
• 06/01/1999

An engineering friend gave me a credo by which all system administrators should live: “Roberta,” he said, “If you’re going to be an engineer, you must realize that there are no problems, only opportunities.”

Last month I helped you get into tune with mixed NT/Unix enterprises and to understand some of the differences. Now that you have all that, what opportunities present themselves?

To start, say you want to be able to access data, whether it resides on a Unix or NT box. NT, in general, offers Telnet and ftp clients and Windows NT Server offers an FTP server. Unix offers Telnet and ftp clients and servers. So we simply use FTP to get and put files from one to the other, right? Beeeeeeep! Does passwords in the clear ring any bells? File access, you say, not transfer, is what you want and need? No problem. Utilities abound—well, at least they exist for accessing that data. But the issues are twofold: First, both the file system structures and permission structures are different. To determine which way to go, you need to ask which file system a solution is oriented toward; then define how to conquer the limitations of file access, authentication, and auditing; and, finally, decide which one to use.

For file access, you have several options:

• Using client software for the opposite system. For example, you could use an NFS client for the desktop that allows PCs to browse NFS shares and mount them, much as they currently map NT drives. Hummingbird Communications Ltd.’s Exceed allows NT or Windows 95 users to emulate X-Windows and cut and paste data from Unix into a Windows-based application. The Windows NT Services for Unix Add-On Pack provides NFS client software that allows Microsoft clients to access files and printers existing on Unix servers.
• Implementing an NFS server on an NT box, thereby allowing Unix clients to gain access to files and printers running Windows NT. Windows NT Services for Unix Add-on Pack offers this.
• Implementing NFS gateway machines on the NT server. The NT server uses NFS to mount file and print resources on the Unix server, then reshares these resources using the NT community SMB protocol. To Unix, the gateway appears to be another Unix system accessing files. The Microsoft client needs no additional software but sees the point of access as another NT share. The Unix administrator maintains file-level access permission. The NT administrator maintains connection-level security.
• Implementing SMB on Unix servers and workstations to allow Unix system access to files on NT hosts. Samba, AS/U, AT&T’s Advanced Server for Unix, and Syntax, Inc.’s TotalNET Advanced Server work this way. The SMB protocol is implemented to support Microsoft clients. It’s managed and configured on the Unix server. To the Microsoft client, the server looks like another Microsoft server. The client needs no additional software. The Unix client may need additional software to access files on the server. Administration of file access varies from Unix file access bits, to default NT tools used by ASU, to a mixture of the two.

File access permissions come in three forms:

• Translated from one OS to the other, such as the way Network Appliance handles it.
• Managed by the integration host, the AT&T ASU approach.
• Implemented by the native file system—NTFS permissions when using the NTFS file system or NIS permissions on an NFS file system.

The problem of password synchronization is usually solved in one of three ways as well:

• You have two accounts and separate passwords—no synchronization.
• One OS becomes the master (you change your password in NT and your Unix account is synchronized, or vice versa). Microsoft’s Windows NT Services for Unix Add-on Pack provides one-way password synchronization with Unix. Change your password in NT and it will be changed on the Unix platform. AT&T’s ASU allows a Unix system to become either a primary or backup domain controller in an NT environment. Logging onto NT allows access to distributed resources managed by the ASU on NT and Unix hosts. A password-management utility may be available on some implementations to coordinate password synchronization from the NT side.
• When you log on with a Unix ID or an NT ID and change a password, the other OS is synchronized.

We Want it All and We Want it Now!

So what should you choose? How do you provide resource access in a mixed environment?

• Determine which platform is primary; that platform dictates your direction. Are most users working under Microsoft Windows? Apply a Microsoft-oriented approach. Multiple products use Microsoft’s SMB or CIFS. Is Unix the primary platform and NT the newcomer? NFS is probably more familiar to your users, so choose utilities that maintain that interface. If your situation lies somewhere between and you’re in need of a compromise, you may need to implement access utilities from both fronts. But remember the mixed blessings inherent in such a choice.
• Choose utilities that allow your users to comfortably access files on an unfamiliar OS, while retaining the levels of security your environment demands.
• Implement the best possible security on both systems. There may be areas where you can use the inherent differences in the system authentication and file access permissions to further protect sensitive files. Remember, just because you need to provide shared file access between disparate systems doesn’t mean you need to expose critical information to unlimited penetration. There’s nothing wrong with insisting that this data be kept separate from shared data and that it be accessible only through native access rather than some translating utility.
• Forego use of enterprise administrative commands if you don’t fully know or understand their use and potential abuse. Don’t judge these utilities by ease of use alone, but by firm understanding of their impact on both operating systems.