Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 359 / 552

Chapter 11.
341
Managing SSL
To provide secure communications over the network, Red Hat Directory Server includes the LDAPS
communications protocol. LDAPS is the standard LDAP protocol, running over Transport Layer
Security (TLS, formerly Secure Sockets Layer or SSL). Directory Server also allows
spontaneous
secure connections over otherwise-insecure LDAP ports, using the Start TLS LDAP extended
operation.
This chapter describes how to use TLS/SSL with Directory Server.
11.1. Introduction to TLS/SSL in the Directory Server
The Directory Server supports TLS/SSL to secure communications between LDAP clients and the
Directory Server, between Directory Servers that are bound by a replication agreement, or between a
database link and a remote database. Directory Server can use TLS/SSL with simple authentication
(bind DN and password) or with certificate-based authentication.
Directory Server's cryptographic services are provided by Mozilla Network Security Services (NSS),
a library of TLS/SSL and base cryptographic functions. NSS includes a software-based cryptographic
token which is FIPS 140-2 certified.
Using TLS/SSL with simple authentication ensures confidentiality and data integrity. There are two
major benefits to using a certificate — smart card, token, or software-based — to authenticate to the
Directory Server instead of a bind DN and password:
• Improved efficiency.
When using applications that prompt once for the certificate database password
and then use that certificate for all subsequent bind or authentication operations, it is more efficient
than continuously providing a bind DN and password.
•
Improved security.
The use of certificate-based authentication is more secure than non-certificate
bind operations because certificate-based authentication uses public-key cryptography. Bind
credentials cannot be intercepted across the network. If the certificate or device is lost, it is useless
without the PIN, so it is immune from third-party interference like phishing attacks.
The Directory Server is capable of simultaneous TLS/SSL and non-SSL communications. This means
that you do not have to choose between TLS/SSL or non-SSL communications for the Directory
Server; both can be used at the same time. Directory Server can also utilize the Start TLS extended
operation to allow TLS/SSL secure communication over a regular (insecure) LDAP port.
11.1.1. Enabling SSL: Summary of Steps
To configure the Directory Server to use LDAPS, follow these steps:
1. Obtain and install a certificate for the Directory Server, and configure the Directory Server to trust
the certification authority's (CA's) certificate.
For information, see
Section 11.2, “Obtaining and Installing Server Certificates”
.
2. Turn on TLS/SSL in the directory.
For information, refer to
Section 11.4, “Starting the Server with TLS/SSL Enabled”
.
3. Configure the Administration Server connect to an SSL-enabled Directory Server.