Novell eDirectory 8.8 Installation Guide - NetIQ

Because port 389 allows clear text, the LDAP server services Read and Write requests to the
Directory through this port. This openness is adequate for environments of trust, where spoofing
doesn't occur and no one inappropriately captures packets.
To disallow clear passwords and other data, select the Require TLS for Simple Bind with Password
option during installation.
novdocx (en) 11 July 2008
As the following figure illustrates, the page gives defaults of 389, 636, and Require TLS for Simple
Bind with Password.
Figure 2-1 Defaults for the LDAP Configuration Screen
Scenario: Require TLS for Simple Bind with Password Is Enabled: Olga is using a client that
asks for a password. After Olga enters a password, the client connects to the server. However, the
LDAP server does not allow the connection to bind to the server over the clear-text port. Everyone is
able to view Olga's password, but Olga is unable to get a bound connection.
The Require TLS for Simple Bind with Password discourages users from sending observable
passwords. If this setting is disabled (that is, not checked), users are unaware that others can observe
their passwords. This option, which does not allow the connection, only applies to the clear-text
port.
If you make a secure connection to port 636 and have a simple bind, the connection is already
encrypted. No one can view passwords, data packets, or bind requests.
Port 636, the Industry-Standard Secure Port
The connection through port 636 is encrypted. TLS (formerly SSL) manages the encryption. By
default, the eDirectory installation selects this port.
30 Novell eDirectory 8.8 Installation Guide