Review the following guidelines for secure communication and authorization in eDirectory:
TLS 1.0 and TLS 1.1 are disabled by default in eDirectory and should not be enabled.
By default, eDirectory operates in FIPS mode and is associated with an RSA certificate. This configuration disallows SSLv3 communication and only allows connections from TLS 1.2 clients.
Disable unencrypted LDAP
During a standard LDAP TLS session, a clear-text connection is established first. Then, the STARTTLS (an extended LDAP operation) is then issued to enable a secure encrypted connection. Finally, authentication takes place in a secure manner. However, a flaw can occur if the LDAP client is configured incorrectly or a client is not configured to use STARTTLS. In such cases, the user name and password are transmitted in clear text before the client software is notified through an error message that authentication requires TLS. This can lead to unauthorized access to usernames and passwords by software that monitors network traffic.
Therefore, it is recommended to disable TLS and use SSL-tunnel encrypted LDAP on port 636, even if TLS is required for LDAP on port 389. This is because the SSL-encrypted tunnel session is established before authentication can occur, which eliminates the risk of transmitting sensitive information in clear text. SSL-tunnel encrypted LDAP is usually on port 636 and is a more secure option.
Even if the LDAP group requires TLS binds, in an attempted unsecured bind, the information is still sent to the server before being denied, and could be captured. Therefore, it is necessary to use TLS for all LDAP server operations.
Make sure that the LDAP proxy user requires TLS for simple binds with a password. If the standard LDAP port 389 is disabled, this requirement is not necessary.
When using eDirectory with a load balancer, whether on cloud or on-premises, it is recommended to not access iMonitor, eMBox, and DHost Console over HTTP traffic. Instead, it is recommended that you disable these modules and perform all related operations using NDS utilities.