Security Features

When DS servers must store sensitive data, and file permissions alone are not sufficient, they use encryption and digests:

• Encryption turns source data into a reversible code. Good design makes it extremely hard to recover the data from the code without the decryption key.

  Encryption uses keys and cryptographic algorithms to convert source data into encrypted codes and back again. Given the decryption key and the details of the algorithm, converting an encrypted code back to source data is straightforward, though it can be computationally intensive.

  DS software does not implement its own versions of all encryption algorithms. Instead, it often relies on cryptographic algorithms provided by the underlying JVM. DS servers do manage access to encryption keys, however. An important part of server configuration concerns key management.

  DS servers use encryption to protect data and backup files on disk. They can encrypt password values when you configure a reversible storage scheme. Another important use of encryption is to make network connections secure.

• A digest (also called a hash) is a non-reversible code generated from source data using a one-way hash function. (A hash function is one that converts input of arbitrary size into output of fixed size.) Good one-way hash design design makes it effectively impossible to retrieve the source data even if you have access to the hash function.

  The hash function makes it simple to test whether a given value matches the original. Convert the value into a digest with the same hash function. If the new digest matches the original digest, then the values are also identical.

  DS server use digests to store hashed passwords, making the original passwords extremely hard to recover. They also use digests for authentication and signing.

The connection handler configuration includes optional security settings. When you configure a handler, specify a key manager provider and a trust manager provider:

• The key manager provider retrieves the server certificate when negotiating a secure connection.

  A key manager provider is backed by a keystore, which stores the server's key pairs.

• The trust manager provider retrieves trusted certificates, such as CA certificates, to verify trust for a certificate presented by a peer when setting up a secure connection.

  A trust manager provider is backed by a keystore that contains trusted certificates, referred to as a truststore when used in this way.

DS servers use cryptographic mechanisms for more than setting up secure connections:

• Encrypted backup files must be decrypted when restored.

• Passwords can be protected by encryption rather than hashing, although this is not recommended.

• Database backends can be encrypted for data confidentiality and integrity.

You can configure the following Crypto Manager features with the dsconfig command:

• Protection for symmetric keys.

• The alias of the shared master key to use for protecting secret keys.

• Cipher key lengths, algorithms, and other advanced properties.

• Access control instructions (ACI)

  Access control instructions provide fine-grained control over LDAP operations permitted for a principal.

  ACIs can be replicated.

• Administrative privileges

  Privileges control access to administrative tasks, such as backup and restore operations, making changes to the configuration, and other tasks.

  Privileges can be replicated.

• Global access control policies

  Global access control policies provide coarse-grained access control for proxy servers, where the lack of local access to directory data makes ACIs a poor fit.

You must monitor deployed services for evidence of threats and other problems. Interfaces for monitoring include the following:

• Remote monitoring facilities that clients applications can access over the network.

  These include JMX and SNMP connection handlers, and the monitor backend that is accessible over LDAP and HTTP.

• Alerts to notify administrators of significant problems or notable events over JMX or by email.

• Account status notifications to send users alerts by email, or to log error messages when an account state changes.

• Logging facilities, including local log files for access, debugging, entry change auditing, and errors. ForgeRock Common Audit event handlers support local logging and sending access event messages to a variety of remote logging and reporting systems.