Security Considerations

Consider several factors to ensure that your environment is secure.

LDAP Port

By default the server and proxy containers listen on a dedicated port for secure LDAP requests (port 9636). To enable the LDAP port, the value of the general.ports.ldap configuration entry must be set.

Note: The ibm-slapdSecurity attribute must not be set, by using the YAML advanced configuration, to change the types of connections accepted by the server.

Sensitive Configuration Information

Sensitive configuration information, for example keys and passwords, must never be stored directly in the YAML configuration file. In a Kubernetes environment, store them in a Kubernetes secret, which in turn can be referenced directly within the YAML configuration file. The format of the YAML configuration to reference an item directly from a Kubernetes secret is secret:{name}/(field}.

For example, to create a secret to store the administrator password the following command can be used.

kubectl create secret generic admin-credentials --from-literal=password=passw0rd

The certificate can then be referenced directly from the configuration YAML.

general:
  admin:
    pwd: secret:admin-credentials/password

Private Keys

Private keys are used by the server to establish a secure connection with a client, or a proxied server. By default a self-signed certificate is generated when the container first starts and is used by the server to establish a secure connection with a client. This self-signed certificate must not be used in a production environment and a certificate that is signed by a trusted authority must be used instead.

The keyfile.keys YAML configuration entry is used to add private keys to the server. Each private key must be in the form of a PEM formatted file that contains both the private key and associated certificate. The private key itself must not be protected by a password. An example combined private key and certificate would look like the following.

-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDbyyZeuPY5NxsR
kwak7mPWHkE3ZZVoAX7dlmoYduMACDP7Hq1WUEFoRLsEPpjXT4I+AR3Wel/ErFu8
....
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIFIjCCAwoCCQDT3C0qfHlMmDANBgkqhkiG9w0BAQsFADBTMQswCQYDVQQGEwJV
UzERMA8GA1UEBwwITmV3IFlvcmsxDDAKBgNVBAoMA0lCTTERMA8GA1UECwwIU2Vj
....
-----END CERTIFICATE-----

By default, the container uses the auto-generated self-signed certificate to establish a secure connection with a client. To use a different key, the general.ssl.cert-label configuration entry must be set to the label of the wanted private key. For example, to configure a server to use a private key the following YAML configuration entries would be used.

general:
  ssl:
    cert-label: server-key

keyfile:
  keys:
  - key: secret:keys/server
    label: server-key

Trusted Certificates

The container is only able to establish a secure connection with a proxied or replicated server when it trusts the certificate that is presented by the server. To establish trust the certificate of the authority that signed the certificate of the proxied or replicated server must be added to the configuration of the container. The keyfile.trusted-certificates configuration entry is used to supply a trusted certificate to the container. An example certificate would look like the following.

-----BEGIN CERTIFICATE-----
MIIFIjCCAwoCCQDT3C0qfHlMmDANBgkqhkiG9w0BAQsFADBTMQswCQYDVQQGEwJV
UzERMA8GA1UEBwwITmV3IFlvcmsxDDAKBgNVBAoMA0lCTTERMA8GA1UECwwIU2Vj
....
-----END CERTIFICATE-----

The keyfile.trusted-certificates configuration entry can then be used to add the certificate to the container.

keyfile:
  trusted-certificates:
  - secret:certificates/example-ca