Read through the following recommendations to protect your eDirectory database or Directory Information Base (DIB):
Always create an encrypted attribute policy to secure sensitive data. For more information, see Encrypting Data in eDirectory.
When using tools like ndscheck and nmasinst, avoid entering passwords in the command line. Instead, wait for the password prompt or use ndspassstore utility to provide password to the tools. For more information, see Setting the sadmin Password.
It is important to safeguard NMAS data, which includes password, secret store, configuration store, and more. To ensure maximum protection, it is recommended to use AES 256-bit key.
All Tree partitions should be replicated across multiple servers.
With only one server storing and serving an eDirectory replica, a server failure would result in the loss of the partition and possibly serious consequences for the rest of the eDirectory tree. To avoid this, it is recommended that every eDirectory partition is replicated on at least three servers.
Take a backup of your eDirectory files.
Managing NetIQ eDirectory can be complex task, which makes it even more important to ensure that it is fully archived. To achieve this, it is recommended to use the eDirectory backup and restore utility. It is important to note that the built-in eDirectory backup requires a file-based backup to be performed as well. During the backup process, eDirectory data is saved to the server's file system. For more information on the processes required to take a full backup, see Backing Up and Restoring NetIQ eDirectory.
Read through the following recommendations to protect the data transmitted between two or more eDirectory servers:
Make sure to have strong ciphers for SSL communication. For more information, see Configuring Protocols and Ciphers Using ldapSSLConfig Attribute.
Strengthen TLS/SSL settings. For more information, see Section 4.0, Secure Communication and Authorization.
Install eDirectory in Suite-B mode.
Suite B is a set of cryptographic algorithms standardized by the National Security Agency (NSA) to allow commercial products to protect traffic that is classified at secret or top secret levels. The Suite B algorithms serve as a method to ensure the security of classified and unclassified information passed through public networks. For more information, see Configuring eDirectory in Suite B Mode.
Configure eDirectory in FIPS mode. Before enabling FIPS, it is recommended to migrate users with NDS password to use PBKDF2 (Password-Based Key Derivation Function 2). For more information, see Operating eDirectory in FIPS Mode in the NetIQ eDirectory Installation Guide and Understanding Non-Reversible Password Storage in the NetIQ eDirectory Administration Guide.