DIRECTORY SERVER SETUP

(OpenLDAP v2)

1. Make sure your LDAP server and client libraries have
   SSL support compiled and working!

   You can test that with Netscape's address book, by configuring
   your LDAP server as an addressbook and checking the Secure
   connection check box.  If you can connect and search, you
   have SSL support.  Otherwise, back to the compiling farm!

   Maybe you need to activate it on the /etc/rc.d/init.d/ldap
   resource file.  Change the line that says daemon slapd to
   daemon slapd -h ldaps://

   Note that there seems to be a bug in slapd as of version
   openldap 2.0.7 that will only allow listening to only ONE
   protocol, either LDAPS or LDAP.  Don't pay attention to the
   man pages.  They are wrong.

2. make sure your slapd.conf includes:

include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/krb5-kdc.schema

3. give write access rights to an administrative account
   that will be used on clients when the UID = 0 (root)
   example: put this at the end of slapd.conf:

    access to attr=userPassword
            by self write
            by anonymous auth
            by dn="DN of the administrative account" write
            by * none

    access to *
            by dn="DN of the administrative account" write
            by * read

(iPlanet Directory Server)
Nothing.

Don't forget to read security.txt in this directory!
