On 11 Mar 2020, at 06:00, Matthew Aguirre
<matt.aguirre(a)einstein-tech.com> wrote:
Is there a way to disable unsecured use of port 389? I am using FreeIPA, so the client
setup uses port 389 with TLS and that is fine, but I'd like to be able to not allow
unsecured connections as much as possible.
I was able to do this in OpenLdap, but haven't seen a comparable solution in ds-389.
Right, so there is one major thing that actually is stopping you here: GSSAPI and Kerberos
that FreeIPA requires.
Why? Well, GSSAPI wants to install it's own encryption layer "sometimes",
and "can't" operate over LDAPS.
This means you *must* leave port 389 exposed for FreeIPA to work.
Even if you set "minssf" or "require secure binds" these actually
don't do a lot to "help" you - why? Because by the time the server can
respond to deny the bind request on plaintext, you already put your password on the wire.
This post may help explain further:
https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.html?hig...
To be 100% clear, LDAPS is the only way to guarantee security and integrity of your
communication today, in a way that can not be misused or have mistakes occur.
You may want to consider raising a bug in FreeIPA to support GSSAPI over LDAPS, so that we
can disable the plaintext port (389 is capable of running only with the LDAPS port :) )
Hope that helps,
--
Matt
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs