Apple Mac OS X Server Command-Line Specifications download pdf (Page 72)

Open Directory Security

With Mac OS X Server, a server with a shared LDAP directory domain also provides

Open Directory authentication.

It is important to protect the authentication data stored by Open Directory. This

authentication data includes the Open Directory Password Server database and the

Kerberos database, which must also be protected. Therefore, make sure an Open

Directory master and all Open Directory replicas are secure by following these

guidelines:

Keep your server behind a locked door, and always log it out. Physical security of a Â

server that is an Open Directory master or replica is paramount.

Secure the media you use to back up an Open Directory Password Server database Â

and a Kerberos database. Having your Open Directory servers behind locked doors

won’t protect a backup tape that you leave on your desk.

Do not use a server that is an Open Directory master or replica to provide other Â

services. If you can’t dedicate servers to be Open Directory masters and replicas,

minimize the number of services they provide.

One of the other services could have a security breach that gives someone access

to the Kerberos or Open Directory Password Server databases. Dedicating servers to

provide Open Directory services is an optimal practice but is not required.

Set up service access control lists (SACLs) for the login window and secure shell Â

(SSH) to limit who can log in to an Open Directory master or replica.

Avoid using a RAID volume that’s shared with other computers as the startup Â

volume of a server that is an Open Directory master or replica. A security breach

on one of the other computers could jeopardize the security of the Open Directory

authentication information.

Set up the rewall service to block all ports except those listed here for directory, Â

authentication, and administration protocols:

Open Directory Password Server uses ports 106 and 3659. Â

The Kerberos KDC uses TCP/UDP port 88, and TCP/UDP port 749 is used for Â

Kerberos administration.

The shared LDAP directory uses TCP port 389 for an ordinary connection and TCP Â

port 636 for an SSL connection.

When creating an Open Directory replica, keep port 22 open between the master Â

and prospective replica. This port is used for SSH data transfer, which is used to

transfer a complete, up-to-date copy of the LDAP database. After initial replica

setup, only the LDAP port (389 or 636) is used for replication.

Workgroup Manager uses TCP port 311 and 625. Â

Server Admin uses TCP port 311. Â

SMB uses TCP/UDP ports 137, 138, 139, and 445. Â

72 Chapter 4 Open Directory Planning and Management Tools

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 294 295

No comments

Apple Mac OS X Server Command-Line Specifications Page 72