Analyzing Security Needs - Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual

Chapter 8. Designing a Secure Directory
For example, if the directory cannot detect tampering, an attacker could change a client's request
to the server (or not forward it) and change the server's response to the client. SSL and similar
technologies can solve this problem by signing information at either end of the connection. For more
information about using SSL with Directory Server, see
Connections".
8.1.3. Denial of Service
In a denial of service attack, the attacker's goal is to prevent the directory from providing service to its
clients. For example, an attacker might use all of the system's resources, thereby preventing these
resources from being used by anyone else.
Directory Server can prevent denial of service attacks by setting limits on the resources allocated to
a particular bind DN. For more information about setting resource limits based on the user's bind DN,
see the "User Account Management" chapter in the Red Hat Directory Server Administrator's Guide.

8.2. Analyzing Security Needs

Analyze the environment and users to identify specific security needs. The site survey in
Designing the Directory Schema
individual pieces of data in the directory. This information forms the basis of the security design.
The way security is implemented also depends on how the directory service is used to support the
business. A directory that serves an intranet does not require the same security measures as a
directory that supports an extranet or e-commerce applications that are open to the Internet.
If the directory only serves an intranet, consider what level of access is needed for information:
• How to provide users and applications with access to the information they need to perform their
jobs.
• How to protect sensitive data regarding employees or the business from general access.
If the directory serves an extranet or supports e-commerce applications over the Internet, there are
additional points to consider:
• How to offer customers a guarantee of privacy.
• How to guarantee information integrity.
The following sections provide information about analyzing security needs.
8.2.1. Determining Access Rights
The data analysis identifies what information users, groups, partners, customers, and applications
need to access the directory service.
Access rights can be granted in one of two ways:
• Grant all categories of users as many rights as possible while still protecting sensitive data.
An open method requires accurately determining what data are sensitive or critical to the business.
• Grant each category of users the minimum access they require to do their jobs.
112
clarifies some basic decisions about who can read and write the
Section 8.9, "Securing Server to Server
Chapter 3,