> On 11 Mar 2020, at 06:00, Matthew Aguirre <matt.aguirre@einstein-tech.com> wrote:
>
> Is there a way to disable unsecured use of port 389? I am using FreeIPA, so the client setup uses port 389 with TLS and that is fine, but I'd like to be able to not allow unsecured connections as much as possible.
>
> I was able to do this in OpenLdap, but haven't seen a comparable solution in ds-389.
Right, so there is one major thing that actually is stopping you here: GSSAPI and Kerberos that FreeIPA requires.
Why? Well, GSSAPI wants to install it's own encryption layer "sometimes", and "can't" operate over LDAPS.
This means you *must* leave port 389 exposed for FreeIPA to work.
Even if you set "minssf" or "require secure binds" these actually don't do a lot to "help" you - why? Because by the time the server can respond to deny the bind request on plaintext, you already put your password on the wire.
This post may help explain further:
https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.html?highlight=minssf
To be 100% clear, LDAPS is the only way to guarantee security and integrity of your communication today, in a way that can not be misused or have mistakes occur.
You may want to consider raising a bug in FreeIPA to support GSSAPI over LDAPS, so that we can disable the plaintext port (389 is capable of running only with the LDAPS port :) )
Hope that helps,
> --
> Matt
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
No comments:
Post a Comment