On 06/05/2013 11:07 AM, Denise Cosso wrote:
Hi,
Anyone know how to do?
Stop the server, and add "nsencryptionalgorithm: AES" or
"nsslapd-encryptionalgorithm: 3DES" to the changelog entry. The current
supported encryption algorithms are AES and 3DES
dn: cn=changelog5,cn=config
objectClass: top
objectClass: extensibleobject
cn: changelog5
nsslapd-changelogdir: /var/lib/dirsrv/slapd-ID/db/changelog
*nsslapd-encryptionalgorithm: AES*
Thanks,
Denise
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users If you already have
configured SSL on your Directory Server, just adding
"nsslapd-encryptionalgorithm: AES" to cn=changelog5,cn=config turns on
the changelog encryption.*
*Then, please restart the server. You'd be able to see this attribute
in your cn=changelog5.
|nsSymmetricKey:: BASE64_STRING|
And if you run, e.g., strings against to your changelog, the attribute
values are encrypted as follows:
# strings 62a1c402-e47611e4-bcd98b6b-27e8b792_55301a33000000010000.db
({replicageneration} 55301a33000000010000
5{replica 1} 55301a44000000010000 55301a44000000010000
0000014d000000000000
[...]
objectClass
_+7B
g`nT
givenName
userPassword
@~$a|F
creatorsName
h@3Z
modifiersName
h@3Z
[...]
Please note that, the encryption starts on the changes made after the
changelog encryption is enabled.*
*Thanks,
--noriko*
*