On Tue, Dec 17, 2019 at 05:01:01PM -0500, Simo Sorce via FreeIPA-users wrote:
The port alone won't tell you anything, in AD communication
happens on
port 389, but is then upgraded via SASL/GSSAPI to use a secure channel
(pretty much like you do with STARTTLS).
On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
> Okay, I’ve narrowed it down to the sssd_be process that has a
> standard ldap connection to the AD servers (at least according to
> lsof -i).
>
> —
> Bob Jones
> Lead Linux Services Engineer
> ITS ECP - Linux Services
>
> > On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
> >
> > That’s good to know, however *something* is talking to Active Directory via
LDAP in an insecure manner. All that is running on these servers are things installed via
yum install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory
for some reason as the Active Directory admins are seeing binds from the IDM servers with
binding type 0 which means an unsigned bind. They show 496 of those connections in the
past 24 hours from our IPA servers.
Hi,
which version of SSSD is running in the IPA servers? With recent version
of SSSD you can try to set
ldap_sasl_mech = GSS-SPNEGO
and check if this causes less messages than the default GSSAPI. If
GSS-SPNEGO is listed as supported value for the ldap_sasl_mech option in
the sssd-ldap man page, your version of SSSD should support it.
Please note that SSSD will try to read the rootDSE of the AD LDAP
service without any authenticate or encryption. Not sure if this might
cause any log messages on the AD side as well.
bye,
Sumit
> >
> > —
> > Bob Jones
> > Lead Linux Services Engineer
> > ITS ECP - Linux Services
> >
> > > On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com> wrote:
> > >
> > > On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
> > > wrote:
> > > > Hello all,
> > > >
> > > > Our Active Directory team is working on a project to get rid of all
> > > > insecure LDAP communications to Active Directory, and it seems our
> > > > FreeIPA servers are doing just that. I did a quick search and
didn’t
> > > > find anything definitive. How do I go about ensuring that LDAP
> > > > queries from my FreeIPA servers are using TLS against the Active
> > > > Directory servers?
> > >
> > > They won't, your servers use a different security channel called
GSSAPI
> > > that is just as good, and is the same security mechanism Windows own
> > > clients use to talk to Active Directory. This should be sufficient.
> > >
> > > HTH,
> > > Simo.
> > >
> > > > Pertinent details:
> > > >
> > > > Server is running on Red Hat Enterprise Linux Server release 7.7
(Maipo) and is version:
> > > >
> > > > ipa-server 4.6.5-11.el7_7.3
> > > > sssd 1.16.4-21.el7
> > > > 389-ds-base 1.3.9.1-10.el7
> > > >
> > > > —
> > > > Bob Jones
> > > > Lead Linux Services Engineer
> > > > ITS ECP - Linux Services
> > > >
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >
> > > --
> > > Simo Sorce
> > > RHEL Crypto Team
> > > Red Hat, Inc
> >
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...