On 07/30/2013 03:55 PM, Chris Hartman wrote:
On Tue, Jul 30, 2013 at 3:07 PM, Dmitri Pal <dpal(a)redhat.com
And as you see all the binds were using a negotiated method.
I wonder if the policy can be tuned to allow only Kerberos
negotiated binds. IMO this would be optimal.
There is no Group Policy that can enforce a specific type of bind that
I'm aware. While secure binds are always supported, there is only a
toggle between "require secure binds" and "allow secure binds." I
don't think there is any other tuning available.
I think there is something to be said for still requiring SSL despite
the fact that binds are encrypted with the keytab as it helps mitigate
AFAIU Kerberos negotiation if implemented properly (which I think is the
case here) mitigates MIM attacks making SSL really not needed.
MSFT is just paranoid about it. The SSL might be needed when you do a
password change but not the bind but I suspect for simplicity MSFT
decided to implement all or nothing approach. Very unfortunate, I should
say... Not for the first time.
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
Looking to carve out IT costs?