Securing SNA Server Files and Directories

If you have installed SNA Server onto an NTFS volume, you can control access to the configuration by using SNA Server Manager. By specifying access permissions for users, you can control who has the ability to administer, change, or view a configuration.

When SNA Server is installed, it creates a single directory tree (the default is C:\SNA) that contains the files needed to configure and use SNA Server. By default, the group account Everyone has full control of the COMCFG share located in the SNAServerRoot\SYSTEM\CONFIG directory. To control access to the configuration files in these shares, follow these guidelines:

• Create domain user accounts to run the SnaBase and SnaServer services. A domain user account is one that is allowed to log on to the network.

• Give full access to the COMCFG share only to SNA Server administrators. Doing this prevents unauthorized users from changing the SNA Server subdomain configuration. You may find it easier to create a group account, like SNA Administrators, instead of assigning permission individually on a user-by-user basis. See your Windows NT documentation for more information on creating and using group accounts.

• Remove sharing on the SNASERV and COMLOGS shares. Only the local computer needs access to these directories in most circumstances. If necessary, assign permissions to these shares to explicit users or groups instead of using the group account Everyone.

• Restrict local access to the SNAServerRoot\System\Config directory by modifying the local NTFS permissions for the directory.

• Disable the Windows NT domain guest account.

It is recommended that at least one domain user or group have Full Control permissions over all the shares, preferably a trusted group such as Administrators. If no user or group has Full Control permissions, the only person who can change the share permissions is the owner of the share. If necessary, this individual can change his or her permissions to Full Control as needed.

Note   Do not remove the group account Everyone, or assign this group No Access permission. A minimum permission level of Read is required for Everyone so that SNA Server-based computers can talk to one another. SNA Server-based computers need to read the COMCFG share, and the SNA Server configuration file within, to function properly.