Selecting The Encryption Cipher; Using Certificate-Based Authentication - Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual

Chapter 11. Managing SSL
Directory Server Key Exchange
Name
fortezza fortezza
fortezza_rc4_128_sha fortezza
fortezza_null fortezza
Table 11.3. SSLv3 Ciphers

11.5.2. Selecting the Encryption Cipher

To select the ciphers for the Directory Server to use, do the following:
1. Make sure TLS/SSL is enabled for the server. For instructions on enabling TLS/SSL, see
Section 11.4, "Starting the Server with TLS/SSL
2. In the Directory Server Console, select the Configuration tab, and then select the topmost entry
in the navigation tree in the left pane.
3. Select the Encryption tab in the right pane.
This displays the current server encryption settings.
4. Click Cipher Setting.
The Cipher Preference dialog box opens.
5. In the Cipher Preference dialog box, specify which ciphers for the Directory Server to use by
selecting them from the list, and click OK.
Unless there is a security reason not to use a specific cipher, select all of the ciphers, except for
none,MD5.
6. In the Encryption tab, click Save.
WARNING
Avoid selecting the none,MD5 cipher because the server will use this option if no
other ciphers are available on the client, instead of refusing the connection. The
none,MD5 cipher is not secure because encryption does not occur.

11.6. Using Certificate-Based Authentication

Directory Server allows certificate-based authentication for the command-line tools (which are LDAP
clients) and for replication communications. Certificate-based authentication can occur between:
• An LDAP client connecting to the Directory Server.
• A Directory Server connecting to another Directory Server by replication or chaining.
A single configuration parameter, nsslapd-certdir, in cn=config in dse.ldif lists the directory
containing the key, certificate, and security files. The directory name should be unique and specific to
the server. For example, the /etc/dirsrv/slapd-instance_name directory contains the key and
360
Encryption Symmetric Key
Algorithm Bit Size
fortezza 80
RC4 128
null (none) N/A
Enabled".
Message
Authentication
SHA
SHA
SHA