Chapter 9. Configuring Secure Connections
By default, clients and users connect to the Red Hat Directory Server over a standard connection. Standard connections do not use any encryption, so information is sent back and forth between the server and client in the clear.
Directory Server supports TLS connections,
STARTTLS connection, and SASL authentication, which provide layers of encryption and security that protect directory data from being read even if it is intercepted.
9.1. Requiring Secure Connections
Directory Server provides the following ways of using encrypted connections:
- LDAPS
- When you use the LDAPS protocol, the connection starts using encryption and either succeeds or fails. However, no unencrypted data is ever send over the network. For this reason, prefer LDAPS instead of using
STARTTLSover unencrypted LDAP. STARTTLSover LDAP- Clients establish an unencrypted connection over the LDAP protocol and then send the
STARTTLScommand. If the command succeeds, all further communication is encrypted.Warning
If theSTARTTLScommand fails and the client does not cancel the connection, all further data, including authentication information, is sent unencrypted over the network. - SASL
- Simple Authentication and Security Layer (SASL) enables you to authenticate a user using external authentication methods, such as Kerberos. For details, see Section 9.10, “Setting up SASL Identity Mapping”.
