[prev in list] [next in list] [prev in thread] [next in thread] 

List:       fedora-directory-users
Subject:    =?utf-8?q?=5B389-users=5D?= Re: Force use of secure connections
From:       William Brown <wbrown () suse ! de>
Date:       2020-03-10 22:54:43
Message-ID: 736D6733-0E3B-4DF8-81CC-60F1346CC32B () suse ! de
[Download RAW message or body]



> On 11 Mar 2020, at 06:00, Matthew Aguirre <matt.aguirre@einstein-tech.com> wrote:
> 
> Is there a way to disable unsecured use of port 389?  I am using FreeIPA, so the \
> client setup uses port 389 with TLS and that is fine, but I'd like to be able to \
> not allow unsecured connections as much as possible. 
> I was able to do this in OpenLdap, but haven't seen a comparable solution in \
> ds-389.

Right, so there is one major thing that actually is stopping you here: GSSAPI and \
Kerberos that FreeIPA requires.

Why? Well, GSSAPI wants to install it's own encryption layer "sometimes", and "can't" \
operate over LDAPS.

This means you *must* leave port 389 exposed for FreeIPA to work.

Even if you set "minssf" or "require secure binds" these actually don't do a lot to \
"help" you - why? Because by the time the server can respond to deny the bind request \
on plaintext, you already put your password on the wire.

This post may help explain further:

https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.html?highlight=minssf


To be 100% clear, LDAPS is the only way to guarantee security and integrity of your \
communication today, in a way that can not be misused or have mistakes occur.

You may want to consider raising a bug in FreeIPA to support GSSAPI over LDAPS, so \
that we can disable the plaintext port (389 is capable of running only with the LDAPS \
port :) )

Hope that helps,


> --
> Matt
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
> Fedora Code of Conduct: \
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: \
> https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: \
> https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org

—
Sincerely,

William Brown

Senior Software Engineer, 389 Directory Server
SUSE Labs
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org



[prev in list] [next in list] [prev in thread] [next in thread]