To set up Netscape Directory Server 4.1 for LDAP key reconstruction

  1. Install Netscape Directory Server 4.1.

    Note: Netscape's servers have some problems with pathnames with spaces in them, so I recommend against using "Program Files". The default is "C:\Netscape\Server4". Use the default.

    For my examples, I will assume that you chose "o=NAI" for your suffix.

  2. Install PGP schemas for Netscape DS (Directory Server).

    Assuming that you've installed DS into C:\Netscape\Server4, copy the files pgp-recon-schema.conf and pgp-remote-prefs-schema.conf into C:\Netscape\Server4\slapd-<instancename>\config.

    Edit ns-schema.conf in this directory and add two more include lines, one for each of these new schema files.

  3. Restart Netscape DS.

    On the "Tasks" page of the Netscape DS Console, click the "Restart the Directory Server" button.

  4. Add a new user for each user wishing to store key reconstruction data.

    Open up the tree for the suffix you chose when you installed DS (o=NAI, etc. The tree doesn't display the "o=", just the value). Right click on the People tree item, and select New | User.

    On the "User" page (tabs are on the left of the window), type in the new user's first and last name into "First Name" and "Last Name", respectively. You may change his User ID if you wish. Finally, type a password for this user into "Password" and "Confirm Password". Click OK.

  5. Set the access permissions to allow the user to add key reconstruction data.

    Right click on the People tree item and select "Set Access Permissions...". Click "New...". Click "View/Edit Syntax..." and change the ACI to:

        (target="ldap:///ou=People, o=NAI")(targetattr="*")(version 3.0;
        acl "PGP Key Reconstruction"; allow (all) (userdnattr = "owner"); )
        

    Changing the "target=" according to the suffix you chose while installing Netscape DS.

  6. Set up PGP to use your server as the key reconstruction server.

    PGPadmin will usually handle setting this up, but for now, you need to manually edit your PGPPrefs.txt and add/change the lines:

        LDAPReconServerType=0
        LDAPReconServer= <LDAPURL>
        

    Where <LDAPURL> is the URL of the newly created user. The URL should look like:

    ldap://<hostname.or.IP>/uid=$USERID, ou=People, o=NAI

    When sending or retrieving key reconstruciton data, you will be prompted for a username and password. The username will be substitued for the strings "$USERID" and "%USERID%" in the LDAP URL.

  7. Send a key to the reconstruction server.

    In PGPkeys, right click on your keypair and select "Send to | Reconstruction Server". Type in 5 questions and answers. Click OK. Type in the key's passphrase and click OK.

    For this box, the User ID is the User ID of the new user and the Password is that user's password.