Okay, I’ve narrowed it down to the sssd_be process that has a standard ldap connection to
the AD servers (at least according to lsof -i).
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
That’s good to know, however *something* is talking to Active Directory via LDAP in an
insecure manner. All that is running on these servers are things installed via yum
install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory for
some reason as the Active Directory admins are seeing binds from the IDM servers with
binding type 0 which means an unsigned bind. They show 496 of those connections in the
past 24 hours from our IPA servers.
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
> On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com> wrote:
>
> On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
> wrote:
>> Hello all,
>>
>> Our Active Directory team is working on a project to get rid of all
>> insecure LDAP communications to Active Directory, and it seems our
>> FreeIPA servers are doing just that. I did a quick search and didn’t
>> find anything definitive. How do I go about ensuring that LDAP
>> queries from my FreeIPA servers are using TLS against the Active
>> Directory servers?
>
> They won't, your servers use a different security channel called GSSAPI
> that is just as good, and is the same security mechanism Windows own
> clients use to talk to Active Directory. This should be sufficient.
>
> HTH,
> Simo.
>
>> Pertinent details:
>>
>> Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is
version:
>>
>> ipa-server 4.6.5-11.el7_7.3
>> sssd 1.16.4-21.el7
>> 389-ds-base 1.3.9.1-10.el7
>>
>> —
>> Bob Jones
>> Lead Linux Services Engineer
>> ITS ECP - Linux Services
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
> --
> Simo Sorce
> RHEL Crypto Team
> Red Hat, Inc
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...