> On 11 Mar 2020, at 06:00, Matthew Aguirre <matt.aguirre@xxxxxxxxxxxxxxxxx> wrote: > > Is there a way to disable unsecured use of port 389? I am using FreeIPA, so the client setup uses port 389 with TLS and that is fine, but I'd like to be able to not allow unsecured connections as much as possible. > > I was able to do this in OpenLdap, but haven't seen a comparable solution in ds-389. Right, so there is one major thing that actually is stopping you here: GSSAPI and Kerberos that FreeIPA requires. Why? Well, GSSAPI wants to install it's own encryption layer "sometimes", and "can't" operate over LDAPS. This means you *must* leave port 389 exposed for FreeIPA to work. Even if you set "minssf" or "require secure binds" these actually don't do a lot to "help" you - why? Because by the time the server can respond to deny the bind request on plaintext, you already put your password on the wire. This post may help explain further: https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.html?highlight=minssf To be 100% clear, LDAPS is the only way to guarantee security and integrity of your communication today, in a way that can not be misused or have mistakes occur. You may want to consider raising a bug in FreeIPA to support GSSAPI over LDAPS, so that we can disable the plaintext port (389 is capable of running only with the LDAPS port :) ) Hope that helps, > -- > Matt > _______________________________________________ > 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
