On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
wrote:
Hello all,
Our Active Directory team is working on a project to get rid of all
insecure LDAP communications to Active Directory, and it seems our
FreeIPA servers are doing just that. I did a quick search and didn’t
find anything definitive. How do I go about ensuring that LDAP
queries from my FreeIPA servers are using TLS against the Active
Directory servers?
They won't, your servers use a different security channel called GSSAPI
that is just as good, and is the same security mechanism Windows own
clients use to talk to Active Directory. This should be sufficient.
HTH,
Simo.
Pertinent details:
Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version:
ipa-server 4.6.5-11.el7_7.3
sssd 1.16.4-21.el7
389-ds-base 1.3.9.1-10.el7
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc