Hello,
i guess that you probably heard about ADV190023. Our AD admin told me that linux servers
which are under my responsibility send an unsigned request to AD, what could be a problem
related to this incomming Ad patch:
https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-bindin....
I am using sssd in "sssd-ad mode." The communication between a linux servers and
our AD is crypted by kerberos, so this should be ok.
I found only one kind of request which could result in potential failure. After mentioned
patching implementation. See please below:
(Wed Feb 5 16:57:21 2020) [sssd[be[AD]]] [be_ptask_execute] (0x0400): Task [AD machine
account password renewal]: executing task, timeout 60 seconds
(Wed Feb 5 16:57:21 2020) [sssd[be[AD]]] [be_ptask_done] (0x0400): Task [AD machine
account password renewal]: finished successfully
(Wed Feb 5 16:57:21 2020) [sssd[be[AD]]] [be_ptask_schedule] (0x0400): Task [AD machine
account password renewal]: scheduling task 86400 seconds from last
Everytime, this task is executed, our AD write into its log that an unsighned request came
from my linux server. I tried to set ldap_tls_cert and ldap_tls_key into sssd.conf which
point to the cert and key generated by our AD, but without success.
I tried to find a proper solution how to sign the request that AD stop complaining, but
nothing usefull found.
My question is. Should I be affraid that after the patching, our AD will stop to
communicate with my linux servers?
Really thanks in advance for your answer. I really appreciate your effort.