[gentoo-hardened] LDAP and RDBMS

[Andrew Ross]

I just wanted to correct a few misconceptions in the parent post.

Adam Lantos wrote:

> I personally prefer Ldap over mysql because of its optimized
> performance, and scalability.

LDAP-accessible directories (eg. OpenLDAP) tend to be heavily optimized
for read operations, with a corresponding performance hit for writes.
Compare this with Relational Database Management Systems (RDBMS), such
as MySQL, which are optimized for both reads and writes. The other main
difference is the data model - LDAP uses an object model, while RDBMS'
use a relational model (obviously).

Personally, I choose LDAP for user/group information, address books,
etc, while print accounting and other usage data goes in a relational
database. OpenLDAP supports a wide range of backends, including MySQL,
so it's possible to provide an LDAP-interface to your RDBMS.

> Ldap is stable enough, and it's much
> more secure than mysql (using TLS for connections, you can set ACLs).

MySQL and most other RDMS' support TLS and/or SSL-secured connections,
as well as fine-grained permissions.

> You can store virtually anything related to users without bothering
> with database schemes - quotas, email accounts, database
> configurations, apache configuration and so on...

LDAP has objectClasses and schema checking.

> Ldap is faster too because of the binary database backend it uses.

MySQL and most other RDBMS' use binary backends too.

>  And much more tools
> support Ldap, so you can use one password to sftp, one password to
> apache htaccess, ... easier than with mysql.

As long as the services support PAM, it's just as easy to use an LDAP
backend as it is to use MySQL.

> -FTP is insecure, because it sends the password in plaintext.

Newer FTP servers (eg. vsftpd) and clients support SSL.

Cheers

Andrew