On ke, 18 joulu 2019, Jones, Bob (rwj5d) via FreeIPA-users wrote:
Let me attack this from a different direction. The reason we are
looking at this is that in January of 2020, Microsoft plans to ship a
security change that will impact the way that accounts perform LDAP
binds and “talk” to Active Directory. The details of this change are
outlined below:
https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-bindin...
The change is now going to be shipped in March 2020, according to
https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/L...
The IPA servers are either binding with unsecured cleartext
credentials
or are not being signed properly by the application according to our AD
admins.
Please talk back to Microsoft support and ask them direct questions
about LDAP + StartTLS operations. There is some confusion as
Microsoft doesn't really make it easier to understand, even with an
updated "LDAP signing summary" table in the Alan La Pietra's blog post I
linked above. Note that the table misses LDAP + StartTLS over port 389
completely.
So, reporting back to the AD admins what Sumit has informed me of so
far, their response is:
If what the person is saying is true then it might not be impactful as
long as it can gracefully handle not being able to do that initial
handoff.
So, I assume I am not the only one in the community aware of the
upcoming change from Microsoft, so I’m really looking for assurance
that our IPA system is not going to break once that change is put in
place.
We did tests of applying the GPOs from the update pages linked above and
in our tests both RHEL IdM trust to Active Directory and direct
integration using SSSD with 'id_provider=ad' worked just fine. May be
they still generate audit messages but for LDAP + SASL GSS-SPNEGO there
should be no impact, I consider those auditing messages for such
situations (and for LDAP + StartTLS) to be rather misleading. We are
going to look into this with more details too.
Microsoft's documents also do not cover completely CLDAP operations
(389/UDP) which are essential for discovering domain controllers and
sites in Active Directory and which are performed anonymously by all
Windows clients.
Thanks,
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
> On Dec 18, 2019, at 3:19 AM, Sumit Bose <sbose(a)redhat.com> wrote:
>
> On Tue, Dec 17, 2019 at 05:01:01PM -0500, Simo Sorce via FreeIPA-users wrote:
>> The port alone won't tell you anything, in AD communication happens on
>> port 389, but is then upgraded via SASL/GSSAPI to use a secure channel
>> (pretty much like you do with STARTTLS).
>>
>> On Tue, 2019-12-17 at 21:56 +0000, Jones, Bob (rwj5d) wrote:
>>> Okay, I’ve narrowed it down to the sssd_be process that has a
>>> standard ldap connection to the AD servers (at least according to
>>> lsof -i).
>>>
>>> —
>>> Bob Jones
>>> Lead Linux Services Engineer
>>> ITS ECP - Linux Services
>>>
>>>> On Dec 17, 2019, at 4:49 PM, Jones, Bob (rwj5d) via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>>>>
>>>> That’s good to know, however *something* is talking to Active Directory
via LDAP in an insecure manner. All that is running on these servers are things installed
via yum install ipa-server. Would sssd or 389 Directory Server be talking to Active
Directory for some reason as the Active Directory admins are seeing binds from the IDM
servers with binding type 0 which means an unsigned bind. They show 496 of those
connections in the past 24 hours from our IPA servers.
>
> Hi,
>
> which version of SSSD is running in the IPA servers? With recent version
> of SSSD you can try to set
>
> ldap_sasl_mech = GSS-SPNEGO
>
> and check if this causes less messages than the default GSSAPI. If
> GSS-SPNEGO is listed as supported value for the ldap_sasl_mech option in
> the sssd-ldap man page, your version of SSSD should support it.
>
> Please note that SSSD will try to read the rootDSE of the AD LDAP
> service without any authenticate or encryption. Not sure if this might
> cause any log messages on the AD side as well.
>
> bye,
> Sumit
>
>>>>
>>>> —
>>>> Bob Jones
>>>> Lead Linux Services Engineer
>>>> ITS ECP - Linux Services
>>>>
>>>>> On Dec 17, 2019, at 4:11 PM, Simo Sorce <simo(a)redhat.com>
wrote:
>>>>>
>>>>> On Tue, 2019-12-17 at 20:09 +0000, Jones, Bob (rwj5d) via
FreeIPA-users
>>>>> wrote:
>>>>>> Hello all,
>>>>>>
>>>>>> Our Active Directory team is working on a project to get rid of
all
>>>>>> insecure LDAP communications to Active Directory, and it seems
our
>>>>>> FreeIPA servers are doing just that. I did a quick search and
didn’t
>>>>>> find anything definitive. How do I go about ensuring that LDAP
>>>>>> queries from my FreeIPA servers are using TLS against the Active
>>>>>> Directory servers?
>>>>>
>>>>> They won't, your servers use a different security channel called
GSSAPI
>>>>> that is just as good, and is the same security mechanism Windows own
>>>>> clients use to talk to Active Directory. This should be sufficient.
>>>>>
>>>>> HTH,
>>>>> Simo.
>>>>>
>>>>>> Pertinent details:
>>>>>>
>>>>>> Server is running on Red Hat Enterprise Linux Server release 7.7
(Maipo) and is version:
>>>>>>
>>>>>> ipa-server 4.6.5-11.el7_7.3
>>>>>> sssd 1.16.4-21.el7
>>>>>> 389-ds-base 1.3.9.1-10.el7
>>>>>>
>>>>>> —
>>>>>> Bob Jones
>>>>>> Lead Linux Services Engineer
>>>>>> ITS ECP - Linux Services
>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
>>>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>>>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>
>>>>> --
>>>>> Simo Sorce
>>>>> RHEL Crypto Team
>>>>> Red Hat, Inc
>>>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>
>> --
>> Simo Sorce
>> RHEL Crypto Team
>> Red Hat, Inc
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland