Configuring Systems to Prevent Eavesdropping

This appendix does not include the procedure for configuring systems so that communication between systems is always conducted securely to prevent eavesdropping.

Some of the required configuration changes are addressed when you configure Identity Synchronization for Windows. For example, on Windows (for Windows 2000 or later), the Windows's password policies require that all password changes must be made using secured methods. Consequently, simply configuring the system partially addresses the security requirement.

However, it is still possible for eavesdroppers to see the bind attempts when Identity Synchronization for Windows components replay bind credentials. To address this issue, you must configure Identity Synchronization for Windows to communicate securely with its Windows data source by configuring the Identity Synchronization for Windows Connectors to trust certificates offered by the Windows’ Active Directory system.

In addition, you must ensure that all clients authenticating to the LDAP store do so over TLS. For PAM clients, you must configure them to trust the LDAP store and ensure that idsconfig specifies TLS:pam_ldap:simple as the only authentication method for the LDAP store.

The root accounts cannot use the passwd command arbitrarily to change an user’s password on PAM client hosts. You might consider this restriction to be a limitation, it depends on whether you trust the PAM client administrators or not.