On ke, 18 joulu 2019, Jones, Bob (rwj5d) via FreeIPA-users wrote:
Let me attack this from a different direction. The reason we are looking at this is that in January of 2020, Microsoft plans to ship a security change that will impact the way that accounts perform LDAP binds and “talk” to Active Directory. The details of this change are outlined below:
https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-a...
The change is now going to be shipped in March 2020, according to https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/LDAP...
The IPA servers are either binding with unsecured cleartext credentials or are not being signed properly by the application according to our AD admins.
Please talk back to Microsoft support and ask them direct questions about LDAP + StartTLS operations. There is some confusion as Microsoft doesn't really make it easier to understand, even with an updated "LDAP signing summary" table in the Alan La Pietra's blog post I linked above. Note that the table misses LDAP + StartTLS over port 389 completely.
So, reporting back to the AD admins what Sumit has informed me of so far, their response is:
If what the person is saying is true then it might not be impactful as long as it can gracefully handle not being able to do that initial handoff.
So, I assume I am not the only one in the community aware of the upcoming change from Microsoft, so I’m really looking for assurance that our IPA system is not going to break once that change is put in place.
We did tests of applying the GPOs from the update pages linked above and in our tests both RHEL IdM trust to Active Directory and direct integration using SSSD with 'id_provider=ad' worked just fine. May be they still generate audit messages but for LDAP + SASL GSS-SPNEGO there should be no impact, I consider those auditing messages for such situations (and for LDAP + StartTLS) to be rather misleading. We are going to look into this with more details too.
Microsoft's documents also do not cover completely CLDAP operations (389/UDP) which are essential for discovering domain controllers and sites in Active Directory and which are performed anonymously by all Windows clients.
Thanks, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
On Dec 18, 2019, at 3:19 AM, Sumit Bose sbose@redhat.com wrote:
On Tue, Dec 17, 2019 at 05:01:01PM -0500, Simo Sorce via FreeIPA-users wrote:
The port alone won't tell you anything, in AD communication happens on port 389, but is then upgraded via SASL/GSSAPI to use a secure channel (pretty much like you do with STARTTLS).
On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
Okay, I’ve narrowed it down to the sssd_be process that has a standard ldap connection to the AD servers (at least according to lsof -i).
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
That’s good to know, however *something* is talking to Active Directory via LDAP in an insecure manner. All that is running on these servers are things installed via yum install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory for some reason as the Active Directory admins are seeing binds from the IDM servers with binding type 0 which means an unsigned bind. They show 496 of those connections in the past 24 hours from our IPA servers.
Hi,
which version of SSSD is running in the IPA servers? With recent version of SSSD you can try to set
ldap_sasl_mech = GSS-SPNEGO
and check if this causes less messages than the default GSSAPI. If GSS-SPNEGO is listed as supported value for the ldap_sasl_mech option in the sssd-ldap man page, your version of SSSD should support it.
Please note that SSSD will try to read the rootDSE of the AD LDAP service without any authenticate or encryption. Not sure if this might cause any log messages on the AD side as well.
bye, Sumit
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
On Dec 17, 2019, at 4:11 PM, Simo Sorce simo@redhat.com wrote:
On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users wrote: > Hello all, > > Our Active Directory team is working on a project to get rid of all > insecure LDAP communications to Active Directory, and it seems our > FreeIPA servers are doing just that. I did a quick search and didn’t > find anything definitive. How do I go about ensuring that LDAP > queries from my FreeIPA servers are using TLS against the Active > Directory servers?
They won't, your servers use a different security channel called GSSAPI that is just as good, and is the same security mechanism Windows own clients use to talk to Active Directory. This should be sufficient.
HTH, Simo.
> Pertinent details: > > Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version: > > ipa-server 4.6.5-11.el7_7.3 > sssd 1.16.4-21.el7 > 389-ds-base 1.3.9.1-10.el7 > > — > Bob Jones > Lead Linux Services Engineer > ITS ECP - Linux Services > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- Simo Sorce RHEL Crypto Team Red Hat, Inc
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- Simo Sorce RHEL Crypto Team Red Hat, Inc
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...