Encrypting Data In eDirectory
263
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
That is, you must decide in advance which attributes you want to encrypt before uploading
the data in clear text into the eDirectory.
WARNING:
Once you have loaded any data into the eDirectory in the clear, you should
not mark an attribute for encryption. Though you can do it, this leads to security problems
listed in Note A.
1b
Start with a clear install (probably including the operating system) on a freshly formatted
and partitioned disk.
This is to ensure that there is no clear text data on the disk. This means you cannot just
take an existing computer which has clear text data previous and re-install eDirectory. You
must have thoroughly erased all traces of data from the disk. Run some kind of secure
erase software, use a magnetic bulk eraser on the disk, or perform something equally
destructive to the data before installing eDirectory.
1c
Configure eDirectory and
set the encryption schemes
that you want on an attribute.
2
Restore the backed up DIB
(that contains the existing clear text data) on the new server. You
can backup the DIB using
DIB Clone
or
Hot Backup
.
3
Destroy any existing clear text data
Any disks (or on other media) with the clear text data on it should be securely wiped. This
includes things like the clear text LDIF file used to bulk load the server, any other server that
was used for replication, or tapes with old backups on them.
Changing the Scheme of the Encrypted Data
The steps require to do this using backup/restore are mentioned below:
1
Change the encryption algorithms
for an attribute.
2
Take a DIB backup. You can backup the DIB using
DIB Clone
or
Hot Backup
.
3
Restore the backed up DIB to a new fresh server, and delete the old server.
4
Destroy any existing clear text data on the old server. This avoids bits and pieces of data with
the old scheme still on the hard disk.
Any disks (or on other media) with the clear text data on it should be securely wiped.This
includes things like the clear text LDIF file used to bulk load the server, any other server that
were used for replication or tapes with old backups on them.
11.3.3 Conclusion
The scenarios listed here are not exhaustive and there might be more scenarios where this problem
occurs. As long as you follow the rule,
No information that would eventually be encrypted should
ever be written to the hard disk (or any other media) in the clear
, the encrypted data will be truly
secure.
Summary of Contents for EDIRECTORY 8.8 SP5
Page 4: ...4 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 72: ...72 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 118: ...118 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 130: ...130 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 188: ...188 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 222: ...222 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 240: ...240 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 264: ...264 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 290: ...290 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 322: ...322 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 540: ...540 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 548: ...548 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 616: ...616 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
