T 2.42 Complexity of the NDS

NDS (Novell Directory Services) allows the installation of a shared, decentralised directory database of all logical and physical resources within a network. Each network resource is represented by a unique entry in this database, regardless of the actual location of the resource. Access to the network or a network resource is not performed via a particular Netware 4.x server (as opposed to Novell Netware 3.x), but via a directory service of the Novell network (refer to S 2.151 Design of an NDS concept).

The NDS is the central resource management component of Novell Netware 4.x, and subsequently, high demands are placed on the correct functioning of this component. The complex possibilities of administration here can result in the impairment of the availability, confidentiality and integrity of the data, and give rise to the following threats:

• Access to the network by a user requires authentication to the NDS. This login takes place on the nearest Netware 4 server that contains the master partition of the directory tree, or at least a copy of it. If an insufficient number of copies is present in the network, all users will require authentication on the same server. Each login places an additional load on the server and the network. This can result in delayed response times during login procedures and impair the availability of resources.

If no copies of the master partition have been placed on other Netware 4 servers, the occurrence of an error in the NDS database makes it impossible to log into the network.

• The higher the number of organisations and sub-organisations within a directory tree, the greater the administrative effort required. In addition to that, the localisation of network resources becomes more and more complicated for the administrators and for the users

• If a location in a WAN does not hold a copy of the related local partition, a failure of the WAN makes it impossible to log into the network from that location.

• The higher the number of copies of a partition created in a WAN, the greater the volume of traffic in the WAN will be, due to the fact that the login date needs to be changed in all copies of the partition each time a user logs in.

• The various versions and patch levels of Novell Netware Version 4 can also hold different versions of the DS.NLM module. However, this information is used by the Netware 4-servers to filter requests for modification to the NDS database. This can prevent the Netware 4 servers from notifying each other of changes to the NDS data, thus resulting in inconsistencies