The port alone won't tell you anything, in AD communication happens on
port 389, but is then upgraded via SASL/GSSAPI to use a secure channel
(pretty much like you do with STARTTLS).
On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
Okay, I’ve narrowed it down to the sssd_be process that has a
standard ldap connection to the AD servers (at least according to
lsof -i).
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
> On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> That’s good to know, however *something* is talking to Active Directory via LDAP in
an insecure manner. All that is running on these servers are things installed via yum
install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory for
some reason as the Active Directory admins are seeing binds from the IDM servers with
binding type 0 which means an unsigned bind. They show 496 of those connections in the
past 24 hours from our IPA servers.
>
> —
> Bob Jones
> Lead Linux Services Engineer
> ITS ECP - Linux Services
>
> > On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com> wrote:
> >
> > On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
> > wrote:
> > > Hello all,
> > >
> > > Our Active Directory team is working on a project to get rid of all
> > > insecure LDAP communications to Active Directory, and it seems our
> > > FreeIPA servers are doing just that. I did a quick search and didn’t
> > > find anything definitive. How do I go about ensuring that LDAP
> > > queries from my FreeIPA servers are using TLS against the Active
> > > Directory servers?
> >
> > They won't, your servers use a different security channel called GSSAPI
> > that is just as good, and is the same security mechanism Windows own
> > clients use to talk to Active Directory. This should be sufficient.
> >
> > HTH,
> > Simo.
> >
> > > Pertinent details:
> > >
> > > Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo)
and is version:
> > >
> > > ipa-server 4.6.5-11.el7_7.3
> > > sssd 1.16.4-21.el7
> > > 389-ds-base 1.3.9.1-10.el7
> > >
> > > —
> > > Bob Jones
> > > Lead Linux Services Engineer
> > > ITS ECP - Linux Services
> > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
> > --
> > Simo Sorce
> > RHEL Crypto Team
> > Red Hat, Inc
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...