Security Administrator's Guide; Trusted Root Containers; Certificate Validation/Revocation Checking; Smart Card Enrollment Edirectory Attributes - Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION 17-07-2007 Installation Manual

Security Administrator's Guide

7
As with any system, good security requires proper configuration. This section lists
recommendations to ensure that the method functions properly.

7.1 Trusted Root Containers

These containers must include only certificates from trusted Certificate Authorities. Administration
of the certificates in these containers should be restricted.

7.2 Certificate Validation/Revocation Checking

Certificate validation should be enabled and revocation checking properly configured. If a CRL
Grace Period is used, the grace period should be limited to a few days. Do not use the CRL Grace
Period as a mechanism to work around a dysfunctional CRL infrastructure.

7.3 Smart Card Enrollment eDirectory Attributes

Administration of the user attributes used for smart card authentication should be restricted to
administrators who are enrolling smart cards for users.
When matching by subject names, the attributes are:
sasAllowableSubjectNames
nclTmpCertSubject
nclTmpCertExpiration
When matching by certificates, the attributes are:
userCertificate
nclTmpCert
nclTmpCertExpTime

7.4 Certificate Matching

The certificate matching settings should be set to Subject Name matching or Certificate matching.
Certificate matching is more restrictive because it checks the login certificate against the list of
certificates configured for the user. The No Matching option should be used only in specific guest
account scenarios as described in the

7.5 Restricting Authentication Methods

Users can be restricted to using the smart card authentication method only. This is accomplished by
restricting the user to a specified NMAS
Guide (http://www.novell.com/documentation/nmas311/index.html)describes how to do this.
Section 5.4.2, "Certificate Matching," on page
authentication sequence. The
TM
34.
NMAS Administration
Security Administrator's Guide
7
41