Red Hat DIRECTORY SERVER 7.1, Administrator'S Manual, Page: 101 / 652

Creating and Maintaining Databases
Chapter 3 Configuring Directory Databases 101
Configuring Database Encryption from the Console
1.
In the Console, open the Directory Server.
2.
Open the “Configuration” tab, and select the “Data” node.
3.
In the “Data” node, select the root you want to edit, such as
dc=example,dc=com
.
4.
Next, select the backend you want to edit, such as
userRoot
.
5.
Select the “Attribute Encryption” tab.
6.
Hit the “Add Attribute” button, and a list of attributes will appear. Select the
attribute you want encrypted. A list will appear; select which encryption
cipher you wish to use.
7.
Repeat step 6 for every attribute you want encrypted. Then hit “Save” to save
your changes.
To delete attributes, select them from the list of encrypted attributes in the
Attribute Encryption table, and hit the “Delete” button. When you hit “Save,” a
dialog box will appear asking if you want to delete the selected attributes. Click on
“yes” to continue with the deletion. Any deleted attributes have to be manually
re-added after you save.
Configuring Database Encryption Using the Command-Line
To configure database encryption from the command-line, use the
ldapmodify
command to add a configuration entry. This example encrypts the
telephoneNumber
attribute with the AES cipher:
ldapmodify -a -p 389 -h localhost -D "cn=directory manager" -w
password33
NOTE To enable database encryption on an attribute with existing stored
data, you have to export the database to LDIF first , then make the
configuration change, then re-import the data to the database. See
“Exporting and Importing an Encrypted Database,” on page 102.
The server does not enforce consistency between encryption
configuration and stored data; therefore, pay careful attention that
all existing data are exported before enabling or disabling
encryption.