---
title: Charmhub | Deploy Userdir Ldap using Charmhub - The Open Operator Collection
description: Deploy the latest version of Userdir Ldap on any cloud.
url: https://charmhub.io/userdir-ldap/docs/hardening
---

# Userdir Ldap

[Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")

* [Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")
* [Monitoring](https://charmhub.io/?filter=monitoring)

Platform:

24.04

22.04

20.04

18.04

16.04

stable 152

```
juju deploy userdir-ldap
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Security Hardening Guidance

## [SSH configuration](https://charmhub.io/userdir-ldap/docs/hardening#p-36774-ssh-configuration)

Here’s a comprehensive list of improvements and considerations for hardening the charm:

1. Stick with curve25519-sha256 as the default `kex-algorithms` charm option and never use weaker algorithms such as diffie-hellman-group14-sha1 or any SHA-1 based KEX algorithms.
2. Consider removing or avoiding `aes128-gcm` from the ciphers charm configuration, since AES-256 is more secure and doesn’t come with a significant performance penalty on modern hardware. Run the following command for increasing the security:

```
juju config userdir-ldap ciphers="chacha20-poly1305@openssh.com,aes256-gcm@openssh.com"
```

Consider removing or not using non-ETM versions like `hmac-sha2-256` in the `macs` configuration. You can also consider dropping `umac-128-etm` as it provides only 128-bit integrity, which might be considered insufficient for some environments.Run the following command for increasing the security:

```
juju config userdir-ldap macs="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com"
```

---