That’s good to know, however *something* is talking to Active Directory via LDAP in an
insecure manner. All that is running on these servers are things installed via yum
install ipa-server. Would sssd or 389 Directory Server be talking to Active Directory for
some reason as the Active Directory admins are seeing binds from the IDM servers with
binding type 0 which means an unsigned bind. They show 496 of those connections in the
past 24 hours from our IPA servers.
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com>
wrote:
On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via FreeIPA-users
wrote:
> Hello all,
>
> Our Active Directory team is working on a project to get rid of all
> insecure LDAP communications to Active Directory, and it seems our
> FreeIPA servers are doing just that. I did a quick search and didn’t
> find anything definitive. How do I go about ensuring that LDAP
> queries from my FreeIPA servers are using TLS against the Active
> Directory servers?
They won't, your servers use a different security channel called GSSAPI
that is just as good, and is the same security mechanism Windows own
clients use to talk to Active Directory. This should be sufficient.
HTH,
Simo.
> Pertinent details:
>
> Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is
version:
>
> ipa-server 4.6.5-11.el7_7.3
> sssd 1.16.4-21.el7
> 389-ds-base 1.3.9.1-10.el7
>
> —
> Bob Jones
> Lead Linux Services Engineer
> ITS ECP - Linux Services
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc