Table of Contents

CiscoWorks2000 CD One
1st Edition Release Notes
(Windows NT)

CiscoWorks2000 CD One
1st Edition Release Notes
(Windows NT)

November 8, 1999

These release notes describe the caveats for the Windows NT server version of CiscoWorks2000 CD One 1st Edition.

These release notes provide the following information:

• CiscoWorks2000 CD One Documentation and Online Resources
  
  
• Time Zone Acronyms and Offset Settings
  
  
• CiscoWorks2000 CD One 1st Edition Notes and Caveats
  
  
• Cisco Connection Online
  
  
• Documentation CD-ROM
  
  

CiscoWorks2000 CD One Documentation and Online Resources

Documentation

• Installing and Setting Up CD One---This document provides installation instructions including both server and client side system requirements, steps for installing and uninstalling, and installation troubleshooting information.
  
  
• Getting Started with the CiscoWorks2000 Server---This document provides information about setting up, administering, and assessing the CiscoWorks2000 Server. The CiscoWorks2000 Server is required and used by all CiscoWorks2000 applications.
  
  
• Using CiscoView---This guide provides information about the use and operation of CiscoView, and also provides descriptions and scenarios for users or prospective users of this management tool.
  
  

Online Resources

• Online Help for CiscoView---CiscoView online help contains detailed information about using CiscoView applications.
  
  
• Device Package Readme Files---These files include information about device, card, and platform support.
  
  
• Device Package Install Instructions---
  http://www.cisco.com/public/sw-center/netmgmt/ciscoview/cvcww-download.shtml
  This online document provides instructions for adding device package support to CiscoView.
  
  

Time Zone Acronyms and Offset Settings

Table 1 lists the time zone acronyms that are supported in the CiscoWorks2000 applications that use the time zone feature. These time zones can be configured on Resource Manager Essentials (RME) managed devices. Details in Table 1 are:

• Offset from Greenwich Mean Time (GMT) (Column 1)
  
  
• Area the time zone covers (Column 2)
  
  
• Time zone string that your CiscoWorks2000 server should be set to (Column 3)
  
  
• How the device time zone might be displayed in RME reports (Column 4)
  
  

When configuring time zones on CiscoWorks2000 servers, use the supported value in Column 3. To make sure that time zones are translated correctly---especially when your devices, servers, and clients are in different time zones---follow these guidelines:

• To set time zones on devices, use the command described in the Cisco IOS Command Reference documentation.
  
  
• To ensure that the time zone is translated correctly, configure your CiscoWorks2000 server with the values in Column 3. To set time zones on CiscoWorks2000 servers, use Windows NT 2000 Control Panel > Date/Time.
  
  

To help you understand the importance of setting time zones correctly, these steps illustrate how time zones are converted as they are passed from devices to servers to clients in different time zones:

CiscoWorks2000 CD One 1st Edition Notes and Caveats

This section contains notes and caveats that apply to CiscoWorks2000 CD One 1st Edition. Caveats are categorized in the following sections, as shown:

• Documentation Errata
  
  
• CiscoView Engine Caveats
  
  
• Device Package Version 1.0 Caveats
  
  
• Integration Utility Caveats
  
  
• CA-Unicenter Adapter Caveats
  
  
• Server, Browser, and Desktop Caveats
  
  

Documentation Errata

The following information was omitted from the CiscoWorks2000 documentation.

The CiscoWorks2000 server software is not designed to be a fully secured environment in and of itself. It provides some of the security controls necessary for a web-based network management system but relies heavily on the end user's own security measures and control to provide a secure computing environment for CiscoWorks2000 applications. The CiscoWorks2000 server provides and requires the following three levels of security:

• General security that is partially implemented by the client components of CiscoWorks2000 and by the system administrator.
  
  
• Server security that is partially implemented by the server components of CiscoWorks2000 and by the system administrator.
  
  
• Application security implemented by the client and server components of the CiscoWorks2000 applications.
  
  

This section describes the general and server security levels. The application security levels are described in Getting Started with the CiscoWorks2000 Server.

General Security Concerns

The CiscoWorks2000 server provides an environment that allows the deployment of web-based network management applications. Web access provides an easy to use and easy to access computing paradigm that is much harder to secure than the traditional style of computing that requires a login to an operating system before applications can be executed.

The CiscoWorks2000 server provides the security mechanisms (authentication and authorization) needed to prevent unauthenticated access to the CiscoWorks2000 server and unauthorized access to CiscoWorks2000 applications. Since the CiscoWorks2000 applications are capable of changing the behavior and security of your network devices, it is critical that access to the applications and servers be limited to those personnel who need access to applications or the data that the applications provide. Limit CiscoWorks2000 logins to just the systems administrator. Limit connectivity access to the CiscoWorks2000 server by putting it behind a firewall.

Server Security

The following are two aspects of CiscoWorks2000 Server security:

• Security imposed by the server components
  
  
• Security imposed by the system administrator
  
  

The CiscoWorks2000 Server uses the security mechanisms of the Windows NT system to protect the code and data files that reside on the server.

Server-Imposed Security

The CiscoWorks2000 Server provides the following security mechanisms:

• Files, File Ownership, and Permissions---CiscoWorks2000 must be installed by the administrator and is installed as the user bin. The CiscoWorks2000 server relies on the security mechanisms of the NTFS filesystem to provide access control on Windows NT systems. If CiscoWorks2000 is installed on a FAT filesystem, most of the security assumptions made about controlled access to files and network management data are not valid. The user bin is created at install time and given a random password. The CiscoWorks2000 server uses the password but the bin user is never intended as a general user of the Windows NT system. No one should ever be required to log on the Windows NT system as bin. All files and directories are owned by bin read and write access to the user bin and the administrator. Temporary files are created as the user bin with permissions set to read-write for the user bin.
  
  
• Runtime---CiscoWorks2000 back-end processes are executed with permissions set to the user bin. Some of the special CiscoWorks2000 server processes are run as a Windows NT service under the "localsystem" user ID.
  
  The following is a list of these processes:
  
  
  • Daemon manager
    
    
  • Web server
    
    
  • Servlet engine
    
    
  • Rcp/rsh service
    
    
  • Tftp service
    
    
  • Corba service
    
    
  • Database engine
    
    

CiscoWorks2000 foreground processes (typically cgi-bin programs or servlets) are executed under the control of the web server and the servlet engine which all run as the user localsystem. The localsystem user has special permissions on the local Windows NT system but has no network permissions.

CiscoWorks2000 provides several services for RCP, TFTP communication with devices. These services are targeted for use by CiscoWorks2000 applications but can be used for purposes other than network management.

The CiscoWorks2000 Server uses the AT command to run software update jobs for the Resource Manager Essentials Software Image Manager application.

Off-machine connectivity---The CiscoWorks2000 daemon manager will not respond to requests to start, stop, register, or show status for CiscoWorks2000 back-end processes from computers other than the CiscoWorks2000 Server.

Access to systems other than the CiscoWorks2000 Server systems used by the CiscoWorks2000 Server as remote sources of device information for importing into the Resource Manager Essentials Inventory Manager application must allow the user bin to perform remote shell operations on the user that owns the device information.

The user bin, created as part of the install process, has no special permissions or considerations on a Windows NT system so it is a "safe" user ID under which to execute the CiscoWorks2000 server and application code. Since the localsystem user on Windows NT systems is capable of performing operations that could be harmful to the system, there are a few things to consider regarding the use of the localsystem user ID for running some of the backend processes. The localsystem user ID is not capable of network operations. Because of this we recommend that the system administrator review and adopt the security recommendations in the System Administrator-Imposed Security section below.

System Administrator-Imposed Security

Web servers have a long history of being susceptible to break ins. The version of the Apache web server that is in the current release of the CiscoWorks2000 Server has had many security related bug fixes. The CiscoWorks2000 Server development team knows of no specific ways to break into back doors to the server.

To maximize CiscoWorks2000 Server security, you should follow these guidelines:

• Do not allow users other than the system administrator to have a login ID on the CiscoWorks2000 Server.
  
  
• Do not allow the CiscoWorks2000 Server file systems to be mounted remotely with NFS or any other file-sharing protocol.
  
  
• Limit remote access (for example, FTP, RCP, RSH) to the CiscoWorks2000 Server to those users who are permitted to log in to the CiscoWorks2000 Server.
  
  
• Place your network management servers behind firewalls to prevent access to the systems from outside of your organization.
  
  

Installation Caveats

CiscoView Engine Caveats

Device Package Version 1.0 Caveats

Integration Utility Caveats

CA-Unicenter Adapter Caveats

Server, Browser, and Desktop Caveats

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

• WWW:  http://www.cisco.com
  
• WWW:  http://www-europe.cisco.com
  
• WWW:  http://www-china.cisco.com
  
• Telnet:  cco.cisco.com
  
  
• Modem:  From North America, 408 526-8070; from Europe, 33 1 64 46 40 82. Use the following terminal settings: VT100 emulation; databits: 8; parity: none; stop bits: 1; and connection rates up to 28.8 kbps.
  
  

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.

If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.