HP UX Direry Server 8.4 Selecting appropriate authentication methods, 8.4.1 Anonymous access

Table 8-1 Security methods available in Directory Server

Security method	Description
Authentication	A means for one party to verify another's identity. For example, a client
	gives a password to Directory Server during an LDAP bind operation.
Password policies	Defines the criteria that a password must satisfy to be considered valid;
	for example, age, length, and syntax.
Encryption	Protects the privacy of information. When data is encrypted, it is
	scrambled in a way that only the recipient can understand.
Access control	Tailors the access rights granted to different directory users and provides
	a means of specifying required credentials or bind attributes.
Account deactivation	Disables a user account, group of accounts, or an entire domain so that
	all authentication attempts are automatically rejected.
Secure connections	Maintains the integrity of information by encrypting connections with
	SSL, Start TLS, or SASL. If information is encrypted during transmission,
	the recipient can determine that it was not modified during transit.
Auditing	Determines if the security of the directory has been compromised; on
	simple auditing method is reviewing the log files maintained by the
	directory.

Combine any number of these tools for maintaining security in the security design, and incorporate other features of the directory service, such as replication and data distribution, to support the security design.

8.4 Selecting appropriate authentication methods

A basic decision regarding the security policy is how users access the directory. Are anonynous users allowed to access the directory, or is every user required to log into the directory with a username and password (authenticate)?

Directory Server provides the following methods for authentication:

•“Anonymous access”

•“Simple password”

•“Certificate-based authentication”

•“Simple password over SSL/TLS”

•“Simple authentication and security layer”

•“Proxy authentication”

The directory uses the same authentication mechanism for all users, whether they are people or LDAP-aware applications.

For information about preventing authentication by a client or group of clients, see “Preventing authentication by account deactivation”.

8.4.1 Anonymous access

Anonymous access provides the easiest form of access to the directory. It makes data available to any user of the directory, regardless of whether they have authenticated.

However, anonymous access does not allow administrators track who is performing what kinds of searches, only that someone is performing searches. With anonymous access, anyone who connects to the directory can access the data.

Therefore, an administrator may attempt to block a specific user or group of users from accessing some kinds of directory data, but, if anonymous access is allowed to that data, those users can still access the data simply by binding to the directory anonymously.

106 Designing a secure directory