On 07/30/2013 03:55 PM, Chris Hartman wrote:
On Tue, Jul 30, 2013 at 3:07 PM, Dmitri Pal <dpal(a)redhat.com
<mailto:dpal@redhat.com>> wrote:
And as you see all the binds were using a negotiated method.
I wonder if the policy can be tuned to allow only Kerberos
negotiated binds. IMO this would be optimal.
There is no Group Policy that can enforce a specific type of bind that
I'm aware. While secure binds are always supported, there is only a
toggle between "require secure binds" and "allow secure binds." I
don't think there is any other tuning available.
I think there is something to be said for still requiring SSL despite
the fact that binds are encrypted with the keytab as it helps mitigate
man-in-the-middle attacks.
-Chris
AFAIU Kerberos negotiation if implemented properly (which I think is the
case here) mitigates MIM attacks making SSL really not needed.
MSFT is just paranoid about it. The SSL might be needed when you do a
password change but not the bind but I suspect for simplicity MSFT
decided to implement all or nothing approach. Very unfortunate, I should
say... Not for the first time.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/