Vol 4, No 6 - 3/4/02

** High Priority **

BrainShare 2002- Almost Here!!
BrainShare 2002 is just around the corner! So get ready, set, go to learn first-hand about Novell's latest products and strategies. Get hands-on technical experience. See the latest third-party offerings. Network. Play in the technology lab. Take a certification test. And have fun! As every year, BrainShare 2002 will be held in Salt Lake City, Utah, at the Salt Palace Convention Center; the dates are March 17 through March 22, 2002. Online registration started December 1, 2001 at www.novellbrainshare.com. See Salt Lake AFTER the Olympics....

Also, Vertical Track available For BrainShare
For the first time ever at BrainShare, a vertical track is available which includes sessions specific to customers who are in Government, Healthcare, Education, Finance and Small Business. Right now there are 20 classes available, but rumor has it that a few more might be added. More info can be found at http://www.novellbrainshare.com/portal/controller/catalog, select the "track" tab and then choose "Industry Vertical Solutions" from the drop-down list.

Northlands Customer Party @ BrainShare - Novell Northland BrainShare Bash
(Iowa, Minnesota, Nebraska, North Dakota, South Dakota, western Wisconsin)
Come enjoy snacks and a cool beverage and meet the Novell Northland Team as well as other attendees from around the Upper Mid-West. We will also give you a special Novell Northland gift.
When : Thursday, March 21 from 8:00 - 11:00pm
Where : Squatters Pub (ask for the Novell Northland Party)
        http://hcisecure.com/squatters/
Questions : Please contact your Technology Account Manager or Ellen Bridenstine at 952-893-2601 or ebridenstine@novell.com
Squatters is located at:
147 West Broadway
Salt Lake City, UT
Tel: (801) 363-2739

Looks like record attendance for customers from Iowa and Nebraska this year!!! Thanks to everyone that wants to get first-hand, updated information. Looking at the sign-up lists though shows not many resellers from Iowa and Nebraska attending. Is your Reseller taking advantage of this great opportunity??? Give them a call and ask if they are going.. If not, how can they expect to support you as you move forward with new technologies???? Do you need a new reseller??

Want to be a part of the BrainShare community...right?
Go here... http://brainsharenetwork.novellbrainshare.com/login.html ...login and join a community. I have set up one for Iowa/Nebraska.. See if you can find it...

While you're at it...join a few more and keep checking back, participate in the discussions, and post some cool info!

Iowa/Nebraska Upcoming Events

Novell Portal Services- STARTING TOMORROW
Novell Portal Services enables organizations to create personal Web portals that give their partners, customers and employees all the relevant information, resources, tools and applications they need to conduct business and execute their daily work responsibilities. Novell Portal Services presents within the user's web browser a customized collection of services and resources, appropriate to the user's specific needs, interests, roles and responsibilities. This is a Free event.

March 5, Des Moines, IA Help Desk PM
http://register.novell.com/login/index.cfm?action=prelogin&fuse=event&id=3129&event_id=3129&lcode=enu

March 6, Omaha, NE Compaq Office AM
http://register.novell.com/login/index.cfm?action=prelogin&fuse=event&id=3130&event_id=3130&lcode=enu

Novell SecureAccess
What is Novell's SecureAccess??
The seminar presenters will discuss Novell's solutions to:

• Simplifying management of access rights to all types of users
• Eliminating password headaches
• Verifying your users' identity through graded authentication

Minneapolis Strictly eBusiness Expo
May 8 and 9 in Minneapolis. Check out http://www.strictlyebusiness.net/strictlyebusiness/mpls/main_mpls.po Guess who has one of the main Keynotes??? See it at http://www.strictlyebusiness.net/strictlyebusiness/mpls/events_keynotes.po

The CIO Corner

Nothing this time...

Technical Tips

Internet Security Systems Security Alert
February 27, 2002
Multiple PHP Vulnerabilities: Remote Compromise Exploit in Circulation

Synopsis:
ISS X-Force has learned of multiple buffer overflow vulnerabilities present in the PHP (Hypertext Preprocessor) scripting language. PHP is a popular server-side scripting language that is used heavily throughout the Internet. PHP is most commonly used in Apache Web server environments, but it is supported by all major Web servers and operating systems. X-Force has verified that a functional exploit for one of the vulnerabilities exists and may be actively circulating in the computer underground.

Impact:
Netcraft reports that as of January 2002, there are over 20.8 million active Apache installations, which account for 57% of the sites surveyed. Secure Space reports that PHP is the most popular Apache module available and there are over 1.44 million active installations.

Affected Platforms:
PHP version 3.10-3.18
PHP version 4.0.1-4.03pl1
PHP version 4.0.2-4.05
PHP version 4.0.6-4.0.7RC2
PHP version 4.0.7RC3-4.1.1

The PHP 4.2.0-dev distribution is not vulnerable. So, is NetWare vulnerable to this? Nope- as of now, we don't support PHP on NetWare.. but it's coming....

Benefits and cost of migration to NW6 or W2K?
Here are some facts http://lennart.regebro.nu/netware/netware_vs_nt some real world comparisons http://www.novell.com/coolsolutions/netware/features/a_demo_w2k_nw6.html oh...and you can't forget this one. This is the end all, be all of information about TOTAL cost of ownership (w/NW5.1 mainly) If you put NW6 in it's place...you need to factor in the new management, new disk options, iFolder, iPrint, and the scalability factors http://www.inter-corporate.com/products/network/tco/ now...go to www.whytheylie.com and you may want to go to www.novell.com/competitive/netware Then...make a call to Gartner and ask them.

After you do all that...search for security issues on NetWare and on Windows 2000. This would be my #1 concern in any environment.

DRDOS? Heard of It Yet?
A new report from Gibson Research (grc.com) is available that details a new and even more pernicious form of DoS attack. Take a look; sounds like everyone will need to be familiar with this one... !

Novell GroupWise Server Discloses Web Installation Path to Remote Users - Known issue?
http://securitytracker.com/alerts/2002/Feb/1003683.html Heard about this?? If you are using GroupWise, I hope so... Yes - this is very, very old news (from 12/99). This is one reason why we switched to a Servlet architecture. Note that GW55 will go into it's discontinued phase start 8/02.

BusinessWeek Online - Software That Asks "Who Goes There?"
It's enough to give any business a headache, let alone a health-insurance company. Tech-support staffers at Thousand Oaks [Calif.]-based insurer Wellpoint (NYSE:WLP - news) say they receive 14,000 calls every month from employees who have forgotten their computer-access passwords for the company's Intranet site and need a manual reset. Each reset can cost anywhere from $25 to as much as $200 for an employee using multiple systems or software programs. For Wellpoint, such remedial efforts translate into a minimum annual cost of more than $4 million. http://biz.yahoo.com/bizwk/020226/umklsgwwb1xczcwdqzbx_a_1.html COME SEE OUR SECUREACCESS Seminar for solutions to these issues!!!

Today's focus: Group therapy
By Dave Kearns
As a NetWare network manager, I'll wager you sometimes feel you're all alone, fighting the Redmond behemoth every day. That is, when you aren't battling against the occasional bug, anomaly or feature inside NetWare itself. Sure, you've got this newsletter, but all I can give you is a pointer to the right tool or a hint at the right solution. It is much better to have comrades at your side during the fight, as well as fellow network warriors to talk over the battle with.

If you're not already a member, you should know that Novell Users International (NUI) might be just what you need. NUI and its predecessor, International NetWare Users (OK, so they're in a naming rut) have been around for almost 20 years, bringing together network managers with their peers, as well as with Novell's marketers and engineers and a smattering of third-party vendors that support the Provo platform.

There are other, more tangible benefits, including:

• The complete Novell Software Evaluation Library at a discount of $65.
• A substantial discount on the Novell Support Connection CD-ROM subscription.
• The NUI Technical Resources pack (a bargain for only $20).
• And the latest perk, a 20% discount on BrainShare 2002 registration.

Cool URLs

Nothing this time...

The Other Guys Corner

.Net Server Delayed Till 2nd Half of 2002
http://zdnet.com.com/2100-1104-849054.html

Windows 2000 SIDHistory Escalation Attack
First of all, when Microsoft introduced the Windows 2000 domains within a forest structure, the domains were introduced as security and replication boundaries. If you had a situation where you needed to keep two divisions of your company completely separate from each other, you could create two domains. Each division could have complete control over their domain and not be able to affect the other. Since they are all part of the same forest, they are able to share a common global catalog, and more importantly a common Exchange 2000 address book. This understanding has been the basis for Windows 2000 designs for the past two years.

Now, Aelita Software has identified a bug that affects this model. Specifically, if you are an administrator for Domain A, and you have a means of modifying the SIDHistory attribute, you could insert the SID from Domain B's Domain Administrator account into yours. This would then give you Administrative level access to Domain B and violate the security barrier. The original whitepaper from Aelita can be found at http://www.aelita.com/solutions/ADSecurity/SIDH_implications.htm.

Microsoft issued a response and an analysis of the problem in MS02-001. Basically, they acknowledged it was a problem but decided it was not too severe. They did release a patch to prevent the SIDHistory value from being read, but it cannot be used between domains within the same forest as it would break replication. Their analysis was that it would be very difficult to manipulate the SIDHistory value. Their recommendation was that if this issue was a problem, separate forests should be considered.

This is not a very good answer for a couple of reasons. First of all, most of the third party tool vendors have methods of manipulating the SIDHistory value as part of their migration suites. This proves that it can be done, so it is only a matter of time before a program is developed to do this. Secondly, Windows 2000 security permits authenticated users of one domain to do an LDAP query to another domain to obtain the SID of any object. This makes it trivial to both locate an administrative SID and add it to a local user account. Microsoft's suggestion of multiple forests makes things such as global email directories and global catalogs difficult to implement. NetWare does not have this kind of privilege escalation problem and neither should Windows.

I recommend that the community push Microsoft to develop a means of disabling the SIDHistory between domains in a forest such that it does not affect replication and other things. Windows 2000 forests should be able to have domains that can be secured from each other. If Microsoft chooses not to do this, this represents a significant issue in designing a flexible Windows 2000 infrastructure.

Cool stuff....

Education

Help Desk, Des Moines, IA

781: Workstation Management with ZENworks 3.2, April 15-19, $1596
3000: Upgrading to NetWare 6, April 1-5, $1596.00
CNA (NetWare 6) Night School - commences Tuesday, February 26th!
Course 561: NetWare 6 Administration coming in April! Call to be placed on the advance waiting list - we expect demand to be high!

Advanced Network Technologies, Omaha, NE

575: NDS Design & Implementation, March 27-29
580: NetWare 5.1 Service & Support, April 22-26
781: Workstation Management with ZENworks 3, May 6-10
3000: Upgrading to NetWare 6, May 20-24 & August 12-16
3001: NetWare 6 Administration, June 24-28

FREE NetWare 6 Workshops!
Novell Education is offering your customers a free, one-day NetWare 6 workshop, taught in major cities worldwide. Attendees will receive hands-on experience with the new features of NetWare 6 and get a taste of the new Upgrading to NetWare 6 (course 3000). The NetWare 6 one-day workshop includes five hours of instruction on the hot new features of NetWare 6, including:

• NetWare Remote Manager
• iMonitor
• Novell iManager
• Native File Access
• iFolder
• iPrint

New Certified Novell Salesperson Courseware Available
The latest edition of Selling Net Services Solutions version 6.0 has just been released. It includes updated materials on Novell's strategy, NetWare 6, new versions of the ZENWORKS family, Security and Provisioning solutions including industry partner examples, increasing your revenues with Novell licensing options, along with coverage of other great Novell solutions. Completing this courseware prepares you to take the Certified Novell Salesperson exam and obtain your CNS certification. http://www.novell.com/partners/channel/academy/spresent.html

DirXML Training This Spring
Novell will be delivering DirXML version 1.1 Advanced Technical Training this Spring. In this intense, four-day, hands-on course, you will learn solutions, configurations, and customization of various shipping drivers; tips and tricks; troubleshooting drivers; debugging; eXtensible Stylesheet Language Transformations (XSLT); applications; and much, much more. Class dates and locations will be:

March 25th       Provo, Utah
April 16th       Tampa, Florida

For a complete course description and registration information, contact Jason Chapman at (801) 861-1784.

Novell Net Solutions Free WebCasts!!!
There will be one web cast for each of the following joint solutions:

4. Secure Partner Portal (SPP) Solution, March 6, 1:00 PM EST, One Hour

The Novell Secure Partner Portal solution allows organizations to extend and secure business-critical information to their partners through a trusted Network environment. The solution taps into the power of Novell and BEA technologies, and the services and consultancy expertise of Cambridge Technology Partners to give organizations the power, the flexibility and the security to fully leverage their partnerships - creating a true competitive advantage for their organization. Register today at www.novellnetsolutions.com or call 800-608-1800.

5. Business Process Management (BPM) Solution, Date and Time TBD

Agenda for all 4 web casts, all times in EST:
1:00 - 1:05 PM: Introduction & Welcome
1:05 - 1:35 PM: Benefits of each Solution presented
1:35 - 1:50 PM: Analyst Speaker
1:50 - 2:00 PM: Q&A and Prize Drawing

ZENworks Free Web Seminar
You're invited to check out what's new with Novell® ZENworks® at a free web seminar on March 12,13,14.

Today's Net economy offers tremendous opportunity, but with it comes added complexity. In this valuable, FREE web seminar you'll learn how to:

• Maximize ROI by reducing redundant administrative tasks, effectively leveraging your hardware and software resources and precisely tracking their usage for reporting and billing.
• Minimize risk in the face of constant change and offer unmatched agility in adapting to changing conditions without disrupting your business.
• Deliver the secure, personalized resources your users need to be completely productive, no matter where they are or what machine they're using.

Partner Information

PartnerNet Requirements
Do you know what they are? Have you met them, or have plans in the works to get your CNEs certified to NetWare 6 and your CNSs updated? If not, head over to www.novell.com/partners/channel/ and click just to the left of the picture where it mentions the 2002 benefits an requirements for the program. You will have to authenticate to the ePortal, then access the information (or sign up if you haven't already) .. Time runs out in June...

Annual Channel Party @ BrainShare
BrainShare attendees, be sure to attend the annual channel party, Monday, March 18, at the Red Rock Brewery. Invitations will be emailed soon with the details. Come enjoy free food and drinks and your chance to mingle with Novell Executives. Don't miss it!

Users Groups- A Great Place To Network- The Person-to-Person Kind

Be sure to visit and support your local NetWare/Network/Novell users group-

Nebraska NetWare Users Group (NNUI)
http://www.gioffre.com/nuiomaha/index.htm
meets second Tuesday of each month (except Jul, Aug)

Lincoln Area NetWare Users Group (LANUG)
members.aol.com/thomstarr/lanug
meets third Tuesday of the month, Noon-1pm, Energy Square/SE Community College

Central Iowa Network Professionals (CINP)
Meetings are held at 3:00pm on the third Thursday of the month.
Check website at www.cinp.net.

Mississippi Valley NetWare Users Group (MVNUG) (Dubuque, Iowa)
Meetings will usually be held on the Second Thursday of the month...
Contact Skip Hefel and board members at MVNUG@DigitalMe.com

Sales Stuff----

Novell Reports First Fiscal Quarter 2002 Results
PROVO, Utah Feb. 28, 2002 Novell, Inc., today reported revenue of $271 million and earnings of $0.02 per share for its first fiscal quarter 2002. More available at the Quarterly Results page at Novell's Investor Relations Web page: http://www.novell.com/company/ir/qresults/

CNN/Money: "Favorite Stock: Novell"
Coming in the same week as the WSJ's "Shareholder Scorecard," (see Jack Messman Perspective), how nice it is to see the words "favorite," "stock," and "Novell," together. Yet more evidence that Novell's investment value to shareholders really is a matter of "perspective." Check out these comments offered by Greg Jackson, portfolio manager for Oakmark Funds, in a February 26 interview with CNN/Money: http://money.cnn.com/2002/02/26/investing/favorite_stock/

New Phone Number for Iowa/Nebraska Account Manager
Steve's numbers now are:
(new) Novell Office #515.537.5300
(same) Cellular Ph #515.250.6194
(same)TollFree Fax #866.618.4712

Administration Information:

Trouble Incident Escalation
I am NOT a Tech Support person... But, if you have an open support incident and it has been open for an unusually long period of time, one of my functions is to help escalate the issue inside Novell Tech Support. I will decide what the 'unusually long period of time' is... If you have a support contract, your issue should be resolved within days (resolved; depending on the level of the support contract, someone should contact you within minutes/hours to start working on it.) Without a support contract, you might face hours/days of waiting before tech support can address your call. So, if you feel you need assistance, send me an e-mail describing the incident, the incident number, and who to contact. If you don't have an open incident, don't get me involved until you do.

How to Get Tech Support

• Call 800-858-4000
  • Use a credit card to pay for an incident
  • Use an incident as part of a Premium Services contract
• Call your favorite local reseller- Many have tech support available from Novell
• OnLine- If you have a support contract, open an incident (as well as update the incident or check its status) at http://support.novell.com/servlet/incident

Want to see how some of our solutions work?
Check them out at the on-line demo city... http://democity.novell.com/staticindex.html

Due a Software Upgrade?
Here is how the process works.... You should receive an e-mail from Novell Sales Operations stating you are entitled, as an upgrade protection customer, the next upgrade for product XYZ... You should then go to the upgrade request site at www.novell.com/licensing/upgfulfill and fill in the appropriate lines and information. Your upgrade should then be shipped second day.... BUT turnaround time is dependent on when the product is actually available for FCS (First Customer Ship), which could be days or weeks after the actual product announcement. If you are then having problems, please let your IA/NE Novell team know so we can get involved.

Previous Editions of this E-Blast
Have you missed previous editions of this newsletter? Want to read them? Thanks to the CINP (Central Iowa Network Professionals), they have posted them all at http://www.cinp.net, Links, then 4th item down under Novell, or directly to http://www.cinp.net/nov_blast.html...

Subscribe to news listservs at:
For GroupWise list: http://www.ngwlist.com
For Syracuse U NetWare list: listserv@listserv.syr.edu with 'subscribe novell' in message body

Disclaimer:
Information contained herein is provided as-is. Opinions are those of the author and may or may not be the same as those of Novell, and are definitely NOT attributable to Novell unless otherwise noted.

John Bezy
Technology Account Manager
Iowa/Nebraska
ph: (402) 291-1808
eFax: (561) 760-6149
fax: (402) 291-4529
Novell-the leading provider of
     Net Services Software
     www.novell.com
jbezy@novell.com