Directory Server security

Learn how a variety of functions can be used to secure your Directory Server secure.

See the following for more information about Directory Server security:

Auditing
Auditing allows you to track the details of certain Directory Server transactions.
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) with the Directory Server
To make communications with your Directory Server more secure, Directory Server can use Secure Sockets Layer (SSL) security and Transport Layer Security (TLS).
Kerberos authentication with the Directory Server
Directory Server allows you to use Kerberos authentication. Kerberos is a network authentication protocol that uses secret key cryptography to provide strong authentication to client and server applications.
Password encryption
The IBM® Tivoli® Directory Server enables you to prevent unauthorized access to user passwords. The administrator may configure the server to encrypt userPassword attribute values in either a one-way encrypting format or a two-way encrypting format. The encrypted passwords are tagged with the encrypting algorithm name so that passwords encrypted in different formats can coexist in the directory. When the encrypting configuration is changed, existing encrypted passwords remain unchanged and continue to work.
Groups and roles
Use groups and roles to organize and control the access or permissions of members.
Administrative access
Use administrative access to control access to specific administrative tasks.
Administrative Roles
While configuring an administrative group member, the root administrator has to explicitly assign an administrative role to the member.
Proxy authorization
The proxy authorization is a special form of authentication. By using this proxy authorization mechanism, a client application can bind to the directory with its own identity but is allowed to perform operations on behalf of another user to access the target directory. A set of trusted applications or users can access the Directory Server on behalf of multiple users.
Access control lists
Access control lists (ACLs) provide a means to protect information stored in a LDAP directory. Administrators use ACLs to restrict access to different portions of the directory, or specific directory entries.
Ownership of LDAP directory objects
Each object in your LDAP directory has at least one owner. Object owners have the power to delete the object. Owners and the server administrator are the only users that can change the ownership properties and the access control list (ACL) attributes of an object. Ownership of objects can be either inherited or explicit.
Password policy
With the use of LDAP servers for authentication, is important that a LDAP server support policies regarding password expiration, failed login attempts, and password rules. Directory Server provides configurable support for all three of these kinds of policies.
Password policy tips
Password policy may not always behave as expected.
Authentication
Use an authentication method to control access within the Directory Server.
Denial of service
Use the denial of service configuration option to protect against denial of service attacks.

Parent topic: Directory Server concepts

Related concepts

Directories
Distinguished names (DNs)
Security property tasks

Related tasks

Enabling object auditing for the Directory Server