Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 378 / 552

Chapter 11. Managing SSL
360
Directory Server
Name
Key Exchange Encryption
Algorithm
Symmetric Key
Bit Size
Message
Authentication
fortezza fortezza fortezza 80 SHA
fortezza_rc4_128_sha fortezza RC4 128 SHA
fortezza_null fortezza null (none) N/A SHA
Table 11.3. SSLv3 Ciphers
11.5.2. Selecting the Encryption Cipher
To select the ciphers for the Directory Server to use, do the following:
1. Make sure TLS/SSL is enabled for the server. For instructions on enabling TLS/SSL, see
Section 11.4, “Starting the Server with TLS/SSL Enabled”
.
2. In the Directory Server Console, select the
Configuration
tab, and then select the topmost entry
in the navigation tree in the left pane.
3. Select the
Encryption
tab in the right pane.
This displays the current server encryption settings.
4. Click
Cipher Setting
.
The
Cipher Preference
dialog box opens.
5. In the
Cipher Preference
dialog box, specify which ciphers for the Directory Server to use by
selecting them from the list, and click
OK
.
Unless there is a security reason not to use a specific cipher, select all of the ciphers, except for
none,MD5
.
6. In the
Encryption
tab, click
Save
.
WARNING
Avoid selecting the
none,MD5
cipher because the server will use this option if no
other ciphers are available on the client, instead of refusing the connection. The
none,MD5
cipher is not secure because encryption does not occur.
11.6. Using Certificate-Based Authentication
Directory Server allows certificate-based authentication for the command-line tools (which are LDAP
clients) and for replication communications. Certificate-based authentication can occur between:
• An LDAP client connecting to the Directory Server.
• A Directory Server connecting to another Directory Server by replication or chaining.
A single configuration parameter,
nsslapd-certdir
, in
cn=config
in
dse.ldif
lists the directory
containing the key, certificate, and security files. The directory name should be unique and specific to
the server. For example, the
/etc/dirsrv/slapd- instance_name
directory contains the key and