Read through the following recommendations to protect your OpenText eDirectory database or Directory Information Base (DIB):
Always create an encrypted attribute policy to secure sensitive data. For more information, see Encrypting Data in OpenText eDirectory.
When using tools like ndscheck and nmasinst, avoid entering passwords in the command line. Instead, wait for the password prompt or use ndspassstore utility to provide password to the tools. For more information, see Setting the sadmin Password.
It is important to safeguard NMAS data, which includes password, secret store, configuration store, and more. To ensure maximum protection, it is recommended to use AES 256-bit key.
All Tree partitions should be replicated across multiple servers.
With only one server storing and serving an OpenText eDirectory replica, a server failure would result in the loss of the partition and possibly serious consequences for the rest of the OpenText eDirectory tree. To avoid this, it is recommended that every OpenText eDirectory partition is replicated on at least three servers.
Take a backup of your OpenText eDirectory files.
Managing OpenText eDirectory can be complex task, which makes it even more important to ensure that it is fully archived. To achieve this, it is recommended to use the OpenText eDirectory backup and restore utility. It is important to note that the built-in OpenText eDirectory backup requires a file-based backup to be performed as well. During the backup process, OpenText eDirectory data is saved to the server's file system. For more information on the processes required to take a full backup, see Backing Up and Restoring OpenText eDirectory.
Read through the following recommendations to protect the data transmitted between two or more OpenText eDirectory servers:
Make sure to have strong ciphers for SSL communication. For more information, see Configuring Protocols and Ciphers Using ldapSSLConfig Attribute.
Strengthen TLS/SSL settings. For more information, see Section 4.0, Secure Communication and Authorization.
Install OpenText eDirectory in Suite-B mode.
Suite B is a set of cryptographic algorithms standardized by the National Security Agency (NSA) to allow commercial products to protect traffic that is classified at secret or top secret levels. The Suite B algorithms serve as a method to ensure the security of classified and unclassified information passed through public networks. For more information, see Configuring OpenText eDirectory in Suite B Mode.
Configure OpenText eDirectory in FIPS mode. Before enabling FIPS, it is recommended to migrate users with NDS password to use PBKDF2 (Password-Based Key Derivation Function 2). For more information, see Operating OpenText eDirectory in FIPS Mode in the OpenText™ eDirectory CE 24.4 (v9.3) Installation Guide and Understanding Non-Reversible Password Storage in the OpenText™ eDirectory CE 24.4 (v9.3) eDirectory Administration Guide.