On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users wrote:
Hello all,
Our Active Directory team is working on a project to get rid of all insecure LDAP communications to Active Directory, and it seems our FreeIPA servers are doing just that. I did a quick search and didn’t find anything definitive. How do I go about ensuring that LDAP queries from my FreeIPA servers are using TLS against the Active Directory servers?
They won't, your servers use a different security channel called GSSAPI that is just as good, and is the same security mechanism Windows own clients use to talk to Active Directory. This should be sufficient.
HTH, Simo.
Pertinent details:
Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version:
ipa-server 4.6.5-11.el7_7.3 sssd 1.16.4-21.el7 389-ds-base 1.3.9.1-10.el7
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...