Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

10.3. Configuring Attribute Encryption

Use the command line or the web console to enable and disable attribute encryption for certain attributes.
To configure that Directory Server stores, for example, telephoneNumber attributes in the userRoot database AES-encrypted:
  1. Optionally, to encrypt existing telephoneNumber attributes, export the database. See Section 10.4.1, “Exporting an Encrypted Database”.
  2. Enable AES encryption for the telephoneNumber attribute in the userRoot database: 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com backend attr-encrypt --add-attr telephoneNumber userRoot
    Copy to Clipboard Toggle word wrap
  3. If you exported the database to encrypt also existing attributes, reimport the database. See Section 10.4.2, “Importing an LDIF File into an Encrypted Database”.
To configure that Directory Server stores, for example, telephoneNumber attributes in the database AES-encrypted:
  1. Optionally, to encrypt existing telephoneNumber attributes, export the database. See Section 10.4.1, “Exporting an Encrypted Database”.
  2. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  3. Select the instance.
  4. Open the Database menu.
  5. Select the suffix entry.
  6. Open the Encrypted Attributes tab.
  7. Enter the name of the attribute to be encrypted.
    View larger image
  8. Click Add Attribute.
  9. If you exported the database to encrypt also existing attributes, reimport the database. See Section 10.4.2, “Importing an LDIF File into an Encrypted Database”.
To configure that Directory Server no longer stores, for example, telephoneNumber attributes encrypted in the userRoot database:
  1. Optionally, to decrypt existing telephoneNumber attributes, export the database. See Section 10.4.1, “Exporting an Encrypted Database”.
  2. Disable encryption for the telephoneNumber attribute in the userRoot database: 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com backend attr-encrypt --del-attr telephoneNumber userRoot
    Copy to Clipboard Toggle word wrap
  3. If you exported the database to decrypt existing attributes, reimport the database. See Section 10.4.2, “Importing an LDIF File into an Encrypted Database”.
To configure that Directory Server stores, for example, telephoneNumber attributes in the database AES-encrypted:
  1. Optionally, to encrypt existing telephoneNumber attributes, export the database. See Section 10.4.1, “Exporting an Encrypted Database”.
  2. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  3. Select the instance.
  4. Open the Database menu.
  5. Select the suffix entry.
  6. Open the Encrypted Attributes tab.
  7. Click the Delete Attribute button to the right of the telephoneNumber attribute.
    View larger image
  8. Click Yes to confirm.
  9. If you exported the database to decrypt existing attributes, reimport the database. See Section 10.4.2, “Importing an LDIF File into an Encrypted Database”.
When you enabled encryption for data that is already in the database:
  • Unencrypted data can persist in the server's database page pool backing file. To remove this data:
    1. Stop the instance: 
      # dsctl instance_name stop
      Copy to Clipboard Toggle word wrap
    2. Delete the /var/lib/dirsrv/slapd-instance_name/db/guardian file: 
      # rm /var/lib/dirsrv/slapd-instance_name/db/guardian
      Copy to Clipboard Toggle word wrap
    3. Start the instance: 
      # dsctl instance_name start
      Copy to Clipboard Toggle word wrap
  • After you enabled encryption and successfully imported the data, delete the LDIF file with the unencrypted data.
  • After enabling encryption, Directory Server deletes and creates a new database when reimporting the data.
  • The replication log file is not encrypted. To protect this data, store it on an encrypted disk.
  • Data in the server's memory (RAM) is unencrypted and can be temporarily stored in swap partitions. To protect this data, set up encrypted swap space.

Important

Even if you delete files that contain unencrypted data, this data can be restored under certain circumstances.
Retour au début
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2025 Red Hat