> In a private LAN we have NT- and Win2k- Workstations with
> Novell-Netware-Clients, getting their IP-Addresses via DHCP.
> On a Suse-7.2-Linux-Box runs Squid, which is the one and only host
> of the private LAN allowed to cross the Firewall with http-related
> A Netware-Server with LDAP installed, translates NDS-Attributes of
> our choice to LDAP.
> According to our Policies only some of our users are allowed to surf
> the net.
> To enable these "privileged" users, we put them into a certain
> NDS-group. On the squidhost every 15 Minutes runs a perlscript, which
> asks the LDAP Server for a list of IP-Adresses, where members of this
> group are currently logged in. This list is than formatted as an
> Client-Adress-ACL for squid.
> Hence users have to authenticate themselves only once to the
> Netware-Server and get enabled or not - independent of their current
> IP-Adresses - iff they are members of this privileged group.
This is even better then social engineering (ok, maybe its exactly that).
Ask for a mouse and get the whole elephant. The only thing i missed
was a short excerpt from some of your logs with your ip's in it :O),
so would i've to check it for myself.
> Dr. H. Rosner
> Stadtverwaltung Jena
> Hauptamt / Datenverarbeitung
A paranioc user :O)
Think about !