Naming and Directory Services (DNS, NIS, and LDAP)

For information about how to set up replica servers, refer to the Administration Guidefor the version of Sun Java System Directory Server that you are using.Planning the LDAP Security ModelTo plan for the security model, you should first consider what identity the LDAPclient should be using to talk to the LDAP server. For example, you must decide if youwant strong authentication to protect the user password flow across the wire, and/orif it is needed to encrypt the session between the LDAP client and the LDAP server toprotect the LDAP data transmitted.The credentialLevel and authenticationMethod attributes in the profile areused for this. There are three possible credential levels for credentialLevel:anonymous, proxy, and proxy anonymous. See “LDAP Naming Services SecurityModel” on page 141 for a detailed discussion of LDAP naming service securityconcepts.Note – If you enable pam_ldap account management, all users must provide apassword any time they log in to the system. A login password is required forauthentication. Therefore, nonpassword-based logins using tools such as rsh,rlogin, orssh will fail if used with pam_ldap.The main decisions you need to make when planning your security model are thefollowing.■■■■■What credential level and authentication methods will LDAP clients use?Will you use TLS?Do you need to be backward compatible with NIS or NIS+? In other words, willclients use pam_unix or pam_ldap?What will the servers’ passwordStorageScheme attribute settings be?How will you set up the Access Control Information?For more information about ACIs, consult the Administration Guide for the versionof Sun Java System Directory Server that you are using.Chapter 10 • Planning Requirements for LDAP Naming Services (Tasks) 157