Let me attack this from a different direction. The reason we are looking at this is that
in January of 2020, Microsoft plans to ship a security change that will impact the way
that accounts perform LDAP binds and “talk” to Active Directory. The details of this
change are outlined below:
The IPA servers are either binding with unsecured cleartext credentials or are not being
signed properly by the application according to our AD admins.
So, reporting back to the AD admins what Sumit has informed me of so far, their response
is:
If what the person is saying is true then it might not be impactful as long as it can
gracefully handle not being able to do that initial handoff.
So, I assume I am not the only one in the community aware of the upcoming change from
Microsoft, so I’m really looking for assurance that our IPA system is not going to break
once that change is put in place.
Thanks,
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
On Dec 18, 2019, at 3:19 AM, Sumit Bose <sbose(a)redhat.com>
wrote:
On Tue, Dec 17, 2019 at 05:01:01PM -0500, Simo Sorce via FreeIPA-users wrote:
> The port alone won't tell you anything, in AD communication happens on
> port 389, but is then upgraded via SASL/GSSAPI to use a secure channel
> (pretty much like you do with STARTTLS).
>
> On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
>> Okay, I’ve narrowed it down to the sssd_be process that has a
>> standard ldap connection to the AD servers (at least according to
>> lsof -i).
>>
>> —
>> Bob Jones
>> Lead Linux Services Engineer
>> ITS ECP - Linux Services
>>
>>> On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>>>
>>> That’s good to know, however *something* is talking to Active Directory via
LDAP in an insecure manner. All that is running on these servers are things installed via
yum install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory
for some reason as the Active Directory admins are seeing binds from the IDM servers with
binding type 0 which means an unsigned bind. They show 496 of those connections in the
past 24 hours from our IPA servers.
Hi,
which version of SSSD is running in the IPA servers? With recent version
of SSSD you can try to set
ldap_sasl_mech = GSS-SPNEGO
and check if this causes less messages than the default GSSAPI. If
GSS-SPNEGO is listed as supported value for the ldap_sasl_mech option in
the sssd-ldap man page, your version of SSSD should support it.
Please note that SSSD will try to read the rootDSE of the AD LDAP
service without any authenticate or encryption. Not sure if this might
cause any log messages on the AD side as well.
bye,
Sumit
>>>
>>> —
>>> Bob Jones
>>> Lead Linux Services Engineer
>>> ITS ECP - Linux Services
>>>
>>>> On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com> wrote:
>>>>
>>>> On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
>>>> wrote:
>>>>> Hello all,
>>>>>
>>>>> Our Active Directory team is working on a project to get rid of all
>>>>> insecure LDAP communications to Active Directory, and it seems our
>>>>> FreeIPA servers are doing just that. I did a quick search and
didn’t
>>>>> find anything definitive. How do I go about ensuring that LDAP
>>>>> queries from my FreeIPA servers are using TLS against the Active
>>>>> Directory servers?
>>>>
>>>> They won't, your servers use a different security channel called
GSSAPI
>>>> that is just as good, and is the same security mechanism Windows own
>>>> clients use to talk to Active Directory. This should be sufficient.
>>>>
>>>> HTH,
>>>> Simo.
>>>>
>>>>> Pertinent details:
>>>>>
>>>>> Server is running on Red Hat Enterprise Linux Server release 7.7
(Maipo) and is version:
>>>>>
>>>>> ipa-server 4.6.5-11.el7_7.3
>>>>> sssd 1.16.4-21.el7
>>>>> 389-ds-base 1.3.9.1-10.el7
>>>>>
>>>>> —
>>>>> Bob Jones
>>>>> Lead Linux Services Engineer
>>>>> ITS ECP - Linux Services
>>>>>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>
>>>> --
>>>> Simo Sorce
>>>> RHEL Crypto Team
>>>> Red Hat, Inc
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
> --
> Simo Sorce
> RHEL Crypto Team
> Red Hat, Inc
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...