Security considerations for replication information

Review the security considerations for the following objects:

• ibm-replicagroup=default: Access controls on this object control who can view or change the replication information stored here. By default, this object inherits the access control from it's parent. You should consider setting access control on this object to restrict access to the replication information. For example, you could define a group that contains users that will be managing replication. This group could be made the owner of the "ibm-replicagroup=default" object and other users given no access to the object.
• cn=replication,cn=localhost: There are two security considerations for this object:
  • Access control on this object controls who is allowed to view or update objects stored here. The default access control allows anonymous users to read most information except for passwords and requires administrator authority to add, change, or delete objects.
  • Objects stored in "cn=localhost" are never replicated to other servers. You can place replication credentials in this container on the server that uses the credential and they will not be accessible to other servers. Alternately, you might choose to place credentials under the "ibm-replicagroup=default" object so that multiple servers share the same credentials.
• cn=IBMpolicies: You can place replication credentials in this container, but the data in it is replicated to any consumers of the server. Placing credentials in cn=replication, cn=localhost is considered more secure.