9.3. Overview of Security Methods

Directory Server offers several methods to design an overall security policy that is adapted to specific needs. The security policy should be strong enough to prevent sensitive information from being modified or retrieved by unauthorized users, but also simple enough to administer easily. A complex security policy can lead to mistakes that either prevent people from accessing information that they need to access or, worse, allow people to modify or retrieve directory information that they should not be allowed to access.

Table 9.1. Security Methods Available in Directory Server

Security Method	Description
Authentication	A means for one party to verify another's identity. For example, a client gives a password to Directory Server during an LDAP bind operation.
Password policies	Defines the criteria that a password must satisfy to be considered valid; for example, age, length, and syntax.
Encryption	Protects the privacy of information. When data is encrypted, it is scrambled in a way that only the recipient can understand.
Access control	Tailors the access rights granted to different directory users and provides a means of specifying required credentials or bind attributes.
Account deactivation	Disables a user account, group of accounts, or an entire domain so that all authentication attempts are automatically rejected.
Secure connections	Maintains the integrity of information by encrypting connections with SSL, Start TLS, or SASL. If information is encrypted during transmission, the recipient can determine that it was not modified during transit. Secure connections can be required by setting a minimum security strength factor.
Auditing	Determines if the security of the directory has been compromised; on simple auditing method is reviewing the log files maintained by the directory.

Combine any number of these tools for maintaining security in the security design, and incorporate other features of the directory service, such as replication and data distribution, to support the security design.