Hi,
As I understand, FreeIPA uses the 389 Directory server as its LDAP implementation. I
wanted to know few things about the LDAP connections and whether they are encrypted by
default. I tried googling, but couldn't find substantive documentation regarding
this.
So far, I know that the Directory Server supports a variety of secure connection types,
namely, on port 389 via STARTTLS, LDAPS (port 636) and SASL. However, I'm unsure about
what exact mechanism is used to secure (client --> server) and (server <-->
server) LDAP connections in FreeIPA, and whether I need to enable any attributes like
"Secure bind" for example, on the FreeIPA server.
In case of client --> server connections, I see that the /etc/ldap/ldap.conf has URI
set to LDAPS, but, running TCPDUMP on a client showed all outgoing connections to FreeIPA
server heading towards port 389. Similarly, I grepped the access logs for STARTTLS
connection indicator as defined in the link below, but couldn't find anything:
https://directory.fedoraproject.org/docs/389ds/howto/howto-starttls.html
I'm specifically looking to understand the security of client to server LDAP
connections, and server to server connections (when replication is set up.)
Replication uses GSSAPI.
"client" is a rather flexible term.
sssd uses GSSAPI.
ipa-client-install does not use TLS by default during discovery as it's
a bit of a chicken and egg problem. If you have the cert chain you can
pass it to ipa-client-install and it will use it for all non-GSSAPI
LDAPI connections.
The connections that IPA services create to the LDAP server use either
startTLS, GSSAPI or ldapi (unix socket).
Connections from the CA to the LDAP server use TLS.
rob