[Fedora-directory-users] Simple Bind only in secured channel

[Rich Megginson]

Dael Maselli wrote:
> Michael Ströder, on 15/06/2008 13.30, wrote:
>> Dael Maselli wrote:
>>>
>>> I _need_ also to support GSSAPI auth, and it doesn't work with SSL!
>>
>> Do you mean you require SASL bind with GSSAPI within the LDAP 
>> connection?
>
> Yes.
>
>>
>> The Kerberos authentication itself is not affected by SSL anyway 
>> since the traffic between clients, KDC and servers is protected by 
>> shared secrets.
>>
>
> Yes, but I remember that if I do something like `ldapsearch -Y GSSAPI 
> -h ldaps://server:636`
> it says that GSSAPI is not supported over SSL. Am I wrong?
Fedora DS does not support this.  Please file a bug for this.  There may 
already be a bug about this too.

>
>>> I don't know so much the LDAP protocol, I though the client asks for
>>> capabilities the server when connect, so if is possible do hide the 
>>> simple
>>> bind capability in clear channel the clients doesn't try simple 
>>> bind. No?
>>
>> A well-implemented LDAP client does not send a bind request before 
>> trying StartTLS ext. op. It simply trys StartTLS if configured to do 
>> so (and without looking at the server's capability which could have 
>> been spoofed by an attacker).
>>
>> But frankly, sometimes when examining what LDAP client applications 
>> (even the ones shipped by expensive big vendors) send on the wire I'm 
>> asking myself what the client developers have smoked before 
>> implementing their application.
>>
>> So, no you can't prevent a client application from misbehaving when 
>> allowing port 389 and requiring StartTLS.
>>
>> Ciao, Michael.
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20080616/1a2e89a4/attachment.bin>