HP UX Direry Server 8 Designing a secure directory

7.2.4 Considering a data master......................................................................................................	95
7.2.5 Determining the subtree to synchronize.................................................................................	96
7.2.6 Interaction with a replicated environment.............................................................................	96
7.2.7 Identifying the directory data to synchronize.........................................................................	97
7.2.8 Synchronizing passwords and installing password services..................................................	98
7.2.9 Defining an update strategy....................................................................................................	98
7.2.10 Editing the sync agreement...................................................................................................	98
7.3 Schema elements sycnhronized between Active Directory and Directory Server..........................	98
7.3.1 User attributes synchronized between Directory Server and Active Directory.....................	99
7.3.2 User schema differences between Directory Server and Active Directory...........................	100
7.3.2.1 Values for cn attributes..................................................................................................	100
7.3.2.2 Password policies..........................................................................................................	100
7.3.2.3 Values for street and streetAddress..............................................................................	101
7.3.2.4 Contraints on the initials attribute................................................................................	101
7.3.3 Group attributes synchronized between Directory Server and Active Directory................	101
7.3.4 Group schema differences between Directory Server and Active Directory........................	102
8 Designing a secure directory...................................................................................	103
8.1 About security threats...................................................................................................................	103
8.1.1 Unauthorized access..............................................................................................................	103
8.1.2 Unauthorized tampering.......................................................................................................	103
8.1.3 Denial of service....................................................................................................................	104
8.2 Analyzing security needs..............................................................................................................	104
8.2.1 Determining access rights.....................................................................................................	104
8.2.2 Ensuring data privacy and integrity.....................................................................................	105
8.2.3 Conducting regular audits....................................................................................................	105
8.2.4 Example security needs analysis...........................................................................................	105
8.3 Overview of security methods......................................................................................................	105
8.4 Selecting appropriate authentication methods.............................................................................	106
8.4.1 Anonymous access................................................................................................................	106
8.4.2 Simple password...................................................................................................................	107
8.4.3 Certificate-based authentication............................................................................................	108
8.4.4 Simple password over SSL/TLS.............................................................................................	108
8.4.5 Simple authentication and security layer..............................................................................	108
8.4.6 Proxy authentication.............................................................................................................	108
8.5 Preventing authentication by account deactivation......................................................................	109
8.6 Designing a password policy........................................................................................................	109
8.6.1 How password policy works.................................................................................................	109
8.6.2 Password policy attributes....................................................................................................	113
8.6.2.1 Password change after reset..........................................................................................	113
8.6.2.2 User-defined passwords................................................................................................	113
8.6.2.3 Password expiration......................................................................................................	114
8.6.2.4 Expiration warning........................................................................................................	114
8.6.2.5 Grace login limit............................................................................................................	114
8.6.2.6 Password syntax checking.............................................................................................	114
8.6.2.7 Password length............................................................................................................	115
8.6.2.8 Password minimum age................................................................................................	115
8.6.2.9 Password history...........................................................................................................	115
8.6.2.10 Password storage schemes..........................................................................................	116
8.6.3 Designing an account lockout policy....................................................................................	116
8.6.4 Designing a password policy in a replicated environment..................................................	116
8.7 Designing access control................................................................................................................	117
8.7.1 About the ACI format............................................................................................................	117
8.7.1.1 Targets...........................................................................................................................	118

6Table of Contents