All,
Microsoft has announced a new vulnerability in its AD domain controllers. They are promising a fix by mid-Jan 2020, but in the meantime they have offered LDAP hardening recommendations so that these controllers are not vulnerable.
Those recommendations are: - enable LDAP channel binding and - LDAP signing on Active Directory Domain Controllers.
(I don't pretend to know what that is.)
My question is -- if our AD admins implement these recommended hardenings, what impact will that have on our sssd clients?
Spike
On Wed, Sep 25, 2019 at 06:32:22PM -0500, Spike White wrote:
All,
Microsoft has announced a new vulnerability in its AD domain controllers. They are promising a fix by mid-Jan 2020, but in the meantime they have offered LDAP hardening recommendations so that these controllers are not vulnerable.
Those recommendations are: - enable LDAP channel binding and - LDAP signing on Active Directory Domain Controllers.
(I don't pretend to know what that is.)
My question is -- if our AD admins implement these recommended hardenings, what impact will that have on our sssd clients?
Hi,
those changes might require to use LDAP with TLS either with START_TLS on the LDAP port or using LDAPS.
Currently SSSD only uses the LDAP port with the AD provider. Additionally SSSD uses SASL/GSSAPI/GSS-SPNEGO for encryption with cannot uses together with TLS in AD.
I'm currently working on patches to allow LDAPS as well and make sure that SASL/GSSAPI/GSS-SPNEGO are set up so that it can be used together with TLS.
HTH
bye, Sumit
Spike
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
On Wed, 2019-09-25 at 18:32 -0500, Spike White wrote:
All,
Microsoft has announced a new vulnerability in its AD domain controllers. They are promising a fix by mid-Jan 2020, but in the meantime they have offered LDAP hardening recommendations so that these controllers are not vulnerable.
Those recommendations are: - enable LDAP channel binding and - LDAP signing on Active Directory Domain Controllers.
(I don't pretend to know what that is.)
My question is -- if our AD admins implement these recommended hardenings, what impact will that have on our sssd clients?
In addition to what Sumit said, you will experience more latency in setting up new connections. as you will need 2/3 roundtrips to set up the TLS channel, and then additional roundtrips to authenticate.
GSS-SPNEGO on the 389 port is a lot more efficient as it combines authentication with setting up a secure channel in a single step.
And it also avoids the complexities of dealing with TLS (distributing custom root CAs to clients, dealing with certificate expiration/revocation, etc...).
sssd-users@lists.fedorahosted.org
-
Simo Sorce -
Spike White -
Sumit Bose