Encrypting Data In eDirectory
253
no
vd
ocx
(e
n)
6 Ap
ril 20
07
This means that Server 1 is enabled for encrypted replication to all the servers in the
replica ring but 1<-->3 is disabled by the administrator.
10.3 Achieving Complete Security While
Encrypting Data
The first important basic rule to be followed before encrypting the data is:
No information that would eventually be encrypted should ever be written to the hard disk (or any
other media) in the clear.
When you mark existing clear text data for encryption, though the data gets encrypted, the existing
clear text data might still be present on some part of hard disk where the DIB resides.
There will be “Left Over” clear text pieces of data in some blocks of database if you try to do
following operations:
Mark existing clear text data for encryption
Change the encryption scheme of an encrypted attribute
The following sections depict deployment scenarios for encrypted data and steps to ensure that the
encrypted data is truly secure:
Section 10.3.1, “Encrypting Data in an All New Setup,” on page 253
Section 10.3.2, “Encrypting Data in an Existing Setup,” on page 254
Section 10.3.3, “Conclusion,” on page 255
10.3.1 Encrypting Data in an All New Setup
In case of a new setup, you would have just installed the operating system and then eDirectory. It is
assured that there is no clear text data present in the hard disk where the DIB resides.
Complete the following steps to ensure that the encrypted data in eDirectory is truly secure:
1
Plan in advance which attributes you want to encrypt and with what scheme.
That is, you must decide in advance which attributes you want to encrypt before uploading the
data in clear text into the eDirectory.
WARNING:
Once you have loaded any data into the eDirectory in the clear, you should not
mark an attribute for encryption. Though you can do it, this leads to security problems.
2
Configure eDirectory and
set the encryption schemes
that you want on an attribute.
3
Load your existing data into the new server.
Bulkloading from an LDIF
file or
replicating with another server
are the two most likely
scenarios. Make sure that if you bulk load, you don’t copy the clear text LDIF file onto the
same hard disk where the DIB resides. (Remember the Rule mentioned: No clear text data can
ever be written to the disk.)
4
Destroy any existing clear text data
Summary of Contents for EDIRECTORY 8.8 SP2
Page 4: ...novdocx en 6 April 2007...
Page 116: ...116 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 128: ...128 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 255: ...256 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 406: ...408 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 563: ...566 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 573: ...576 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 601: ...604 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
