On Tue, Dec 17, 2019 at 05:01:01PM -0500, Simo Sorce via FreeIPA-users wrote:
The port alone won't tell you anything, in AD communication happens on port 389, but is then upgraded via SASL/GSSAPI to use a secure channel (pretty much like you do with STARTTLS).
On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
Okay, I’ve narrowed it down to the sssd_be process that has a standard ldap connection to the AD servers (at least according to lsof -i).
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
That’s good to know, however *something* is talking to Active Directory via LDAP in an insecure manner. All that is running on these servers are things installed via yum install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory for some reason as the Active Directory admins are seeing binds from the IDM servers with binding type 0 which means an unsigned bind. They show 496 of those connections in the past 24 hours from our IPA servers.
Hi,
which version of SSSD is running in the IPA servers? With recent version of SSSD you can try to set
ldap_sasl_mech = GSS-SPNEGO
and check if this causes less messages than the default GSSAPI. If GSS-SPNEGO is listed as supported value for the ldap_sasl_mech option in the sssd-ldap man page, your version of SSSD should support it.
Please note that SSSD will try to read the rootDSE of the AD LDAP service without any authenticate or encryption. Not sure if this might cause any log messages on the AD side as well.
bye, Sumit
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
On Dec 17, 2019, at 4:11 PM, Simo Sorce simo@redhat.com wrote:
On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users wrote:
Hello all,
Our Active Directory team is working on a project to get rid of all insecure LDAP communications to Active Directory, and it seems our FreeIPA servers are doing just that. I did a quick search and didn’t find anything definitive. How do I go about ensuring that LDAP queries from my FreeIPA servers are using TLS against the Active Directory servers?
They won't, your servers use a different security channel called GSSAPI that is just as good, and is the same security mechanism Windows own clients use to talk to Active Directory. This should be sufficient.
HTH, Simo.
Pertinent details:
Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version:
ipa-server 4.6.5-11.el7_7.3 sssd 1.16.4-21.el7 389-ds-base 1.3.9.1-10.el7
— Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- Simo Sorce RHEL Crypto Team Red Hat, Inc
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- Simo Sorce RHEL Crypto Team Red Hat, Inc
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...