From a26ab5116ce66a643d042dc9dfef2057dc5ffb83 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 30 Nov 2018 17:45:16 +0100
Subject: [PATCH] Require secure-binds for password login

nsslapd-require-secure-binds restricts password based simple binds to
secure connections. It does not prevent a careless user from
transmitting a password in plain text. But it makes it obvious that he
did something bad. Password based bind attempts over an insecure
connections are refused with:

  Confidentiality required: Operation requires a secure connection

Secure connections are:

* LDAP connections on port 389 with STARTTLS
* LDAPS connections in port 636
* LDAPI connections to a local Unix sockets

Anonymous bind (simple_bind with empty DN and password) and GSSAPI
bind operations are not affected.

nsslapd-require-secure-binds is enabled after 389-DS is configured for
TLS/SSL.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 install/share/Makefile.am       | 1 +
 install/share/secure-binds.ldif | 6 ++++++
 ipaserver/install/dsinstance.py | 4 ++++
 3 files changed, 11 insertions(+)
 create mode 100644 install/share/secure-binds.ldif

diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index d8e627288b..0ddf5a1ff8 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -80,6 +80,7 @@ dist_app_DATA =				\
 	replica-automember.ldif		\
 	sasl-mapping-fallback.ldif	\
 	schema-update.ldif		\
+	secure-binds.ldif		\
 	vault.ldif			\
 	kdcproxy-enable.uldif		\
 	kdcproxy-disable.uldif		\
diff --git a/install/share/secure-binds.ldif b/install/share/secure-binds.ldif
new file mode 100644
index 0000000000..d6dddb8bd5
--- /dev/null
+++ b/install/share/secure-binds.ldif
@@ -0,0 +1,6 @@
+# config
+dn: cn=config
+changetype: modify
+replace: nsslapd-require-secure-binds
+nsslapd-require-secure-binds: on
+
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 2335a48ae4..f96482e3a6 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -323,6 +323,7 @@ def enable_ssl(self):
         else:
             self.step("importing CA certificates from LDAP",
                       self.__import_ca_certs)
+        self.step("require secure binds", self.__secure_binds)
         self.step("restarting directory server", self.__restart_instance)
 
         self.start_creation()
@@ -1212,6 +1213,9 @@ def __root_autobind(self):
             dm_password=self.dm_password
         )
 
+    def __secure_binds(self):
+        self._ldap_mod("secure-binds.ldif")
+
     def __add_sudo_binduser(self):
         self._ldap_mod("sudobind.ldif", self.sub_dict)
 
