HP-UX Directory Server 8.1 deployment guide

Table 8-1 Security methods available in Directory Server
DescriptionSecurity method
A means for one party to verify another's identity. For example, a client
gives a password to Directory Server during an LDAP bind operation.
Authentication
Defines the criteria that a password must satisfy to be considered valid;
for example, age, length, and syntax.
Password policies
Protects the privacy of information. When data is encrypted, it is
scrambled in a way that only the recipient can understand.
Encryption
Tailors the access rights granted to different directory users and provides
a means of specifying required credentials or bind attributes.
Access control
Disables a user account, group of accounts, or an entire domain so that
all authentication attempts are automatically rejected.
Account deactivation
Maintains the integrity of information by encrypting connections with
SSL, Start TLS, or SASL. If information is encrypted during transmission,
the recipient can determine that it was not modified during transit.
Secure connections
Determines if the security of the directory has been compromised; on
simple auditing method is reviewing the log files maintained by the
directory.
Auditing
Combine any number of these tools for maintaining security in the security design, and incorporate
other features of the directory service, such as replication and data distribution, to support the
security design.
8.4 Selecting appropriate authentication methods
A basic decision regarding the security policy is how users access the directory. Are anonynous
users allowed to access the directory, or is every user required to log into the directory with a
username and password (authenticate)?
Directory Server provides the following methods for authentication:
• “Anonymous access”
• “Simple password”
• “Certificate-based authentication”
• “Simple password over SSL/TLS”
• “Simple authentication and security layer”
• “Proxy authentication”
The directory uses the same authentication mechanism for all users, whether they are people or
LDAP-aware applications.
For information about preventing authentication by a client or group of clients, see “Preventing
authentication by account deactivation”.
8.4.1 Anonymous access
Anonymous access provides the easiest form of access to the directory. It makes data available
to any user of the directory, regardless of whether they have authenticated.
However, anonymous access does not allow administrators track who is performing what kinds
of searches, only that someone is performing searches. With anonymous access, anyone who
connects to the directory can access the data.
Therefore, an administrator may attempt to block a specific user or group of users from accessing
some kinds of directory data, but, if anonymous access is allowed to that data, those users can
still access the data simply by binding to the directory anonymously.
106 Designing a secure directory