Encrypting Data In eDirectory
261
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
Server 3 Disabled
This means that Server 1 is enabled for encrypted replication to all the servers in the
replica ring but 1<-->3 is disabled by the administrator.
11.3 Achieving Complete Security While
Encrypting Data
The first important basic rule to be followed before encrypting the data is:
No information that would eventually be encrypted should ever be written to the hard disk (or any
other media) in the clear.
When you mark existing clear text data for encryption, though the data gets encrypted, the existing
clear text data might still be present on some part of hard disk where the DIB resides.
There will be “Left Over” clear text pieces of data in some blocks of database if you try to do
following operations:
Mark existing clear text data for encryption
Change the encryption scheme of an encrypted attribute
The following sections depict deployment scenarios for encrypted data and steps to ensure that the
encrypted data is truly secure:
Section 11.3.1, “Encrypting Data in an All New Setup,” on page 261
Section 11.3.2, “Encrypting Data in an Existing Setup,” on page 262
Section 11.3.3, “Conclusion,” on page 263
11.3.1 Encrypting Data in an All New Setup
In case of a new setup, you would have just installed the operating system and then eDirectory. It is
assured that there is no clear text data present in the hard disk where the DIB resides.
Complete the following steps to ensure that the encrypted data in eDirectory is truly secure:
1
Plan in advance which attributes you want to encrypt and with what scheme.
That is, you must decide in advance which attributes you want to encrypt before uploading the
data in clear text into the eDirectory.
WARNING:
Once you have loaded any data into the eDirectory in the clear, you should not
mark an attribute for encryption. Though you can do it, this leads to security problems.
2
Configure eDirectory and
set the encryption schemes
that you want on an attribute.
3
Load your existing data into the new server.
Bulkloading from an LDIF
file or
replicating with another server
are the two most likely
scenarios. Make sure that if you bulk load, you don’t copy the clear text LDIF file onto the
same hard disk where the DIB resides. (Remember the Rule mentioned: No clear text data can
ever be written to the disk.)
Summary of Contents for EDIRECTORY 8.8 SP5
Page 4: ...4 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 72: ...72 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 118: ...118 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 130: ...130 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 188: ...188 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 222: ...222 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 240: ...240 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 264: ...264 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 290: ...290 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 322: ...322 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 540: ...540 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 548: ...548 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 616: ...616 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
