HP UX Direry Server manual 103

7.2.4 Considering a data master	95
7.2.5 Determining the subtree to synchronize	96
7.2.6 Interaction with a replicated environment	96
7.2.7 Identifying the directory data to synchronize	97
7.2.8 Synchronizing passwords and installing password services	98
7.2.9 Defining an update strategy	98
7.2.10 Editing the sync agreement	98
7.3 Schema elements sycnhronized between Active Directory and Directory Server	98
7.3.1 User attributes synchronized between Directory Server and Active Directory	99
7.3.2 User schema differences between Directory Server and Active Directory	100
7.3.2.1 Values for cn attributes	100
7.3.2.2 Password policies	100
7.3.2.3 Values for street and streetAddress	101
7.3.2.4 Contraints on the initials attribute	101
7.3.3 Group attributes synchronized between Directory Server and Active Directory	101
7.3.4 Group schema differences between Directory Server and Active Directory	102
8 Designing a secure directory	103
8.1 About security threats	103
8.1.1 Unauthorized access	103
8.1.2 Unauthorized tampering	103
8.1.3 Denial of service	104
8.2 Analyzing security needs	104
8.2.1 Determining access rights	104
8.2.2 Ensuring data privacy and integrity	105
8.2.3 Conducting regular audits	105
8.2.4 Example security needs analysis	105
8.3 Overview of security methods	105
8.4 Selecting appropriate authentication methods	106
8.4.1 Anonymous access	106
8.4.2 Simple password	107
8.4.3 Certificate-based authentication	108
8.4.4 Simple password over SSL/TLS	108
8.4.5 Simple authentication and security layer	108
8.4.6 Proxy authentication	108
8.5 Preventing authentication by account deactivation	109
8.6 Designing a password policy	109
8.6.1 How password policy works	109
8.6.2 Password policy attributes	113
8.6.2.1 Password change after reset	113
8.6.2.2 User-defined passwords	113
8.6.2.3 Password expiration	114
8.6.2.4 Expiration warning	114
8.6.2.5 Grace login limit	114
8.6.2.6 Password syntax checking	114
8.6.2.7 Password length	115
8.6.2.8 Password minimum age	115
8.6.2.9 Password history	115
8.6.2.10 Password storage schemes	116
8.6.3 Designing an account lockout policy	116
8.6.4 Designing a password policy in a replicated environment	116
8.7 Designing access control	117
8.7.1 About the ACI format	117
8.7.1.1 Targets	118

6Table of Contents