LDAP-UX Client Services B.05.00 Administrator's Guide
2. Select and execute one of the following steps:
• Either LDAP-UX must not be used for host-name resolution by removing “ldap” from
the “hosts” service in the /etc/nsswitch.conf file.
• Or the host name and IP address must be provided by some other name resolution
service, such as “files” or “dns”, and that service must appear before “ldap” in the
/etc/nsswitch.conf file for the “hosts” service.
2.4.6.2.2.1 Modifying preferredServerList in the LDAP-UX profile
Use the following steps to modify the value of the preferredServerList attribute in the
LDAP-UX configuration profile:
1. Run the following steps to find the name of the LDAP server used on the server certificate.
Assuming this certificate has been installed in your local certificate database file, /etc/
opt/ldapux/cert8.db:
• Run the following commands to list all server certificates used by LDAP-UX:
cd /etc/opt/ldapux
certutil -d . -L
• Run the following command to select the nickname of the certificate from the above
list:
certutil -d . -L -n <selected nickname>
• Select the first name component of the “Subject:” name. For example, if the
“Subject:” string is “CN=ldapserver.example.com, O=Example Corp” then
the name component would be “ldapserver.example.com".
NOTE: Depending on how your certificate administrator manages your network, the above
server certificate may not be found in your cert8.db file. Instead you may only find
certificates for any trusted Certificate Authorities. In this case, contact your certificate
administrator for the LDAP server certificate details.
2. In a separate window, use the ldapentry tool to modify the value of the
preferredServerList attribute with the LDAP server name found in step 1. See
Section 5.12 (page 183) for detailed information on changing LDAP-UX configuration profile
settings manually.
3. Examine the “preferedServerList” attribute
4. Use the nslookup tool to verify the IP address specified in the preferred server list matches
that of the name of the host name found in step 1 above.
For example, if the preferredserverlist attribute value is 192.168.1.1:636 and “Subject”
is CN=ldapserver.example.com,O=Example Corp, then
$ nslookup 192.168.1.1
Name Server: dns-resolver.example.com
Address: 192.169.1.254
Trying DNS
Name: ldapserver.example.com
Address: 192.168.1.1
2.4.6.3 SSL/TLS ciphers
The SSL/TLS protocols support a variety of different cryptographic algorithms called ciphers for
use in operations such as authenticating the server and client to each other, transmitting
certificates, and establishing session keys. When an LDAP client connects to an LDAP directory
server, the server usually picks the strongest cipher supported by both client and server. Clients
82 Installing and configuring LDAP-UX Client Services