<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 05/09/2012 03:11 PM, Steven Jones wrote:
<blockquote
cite="mid:833D8E48405E064EBC54C84EC6B36E404CC90AF4@STAWINCOX10MBX1.staff.vuw.ac.nz"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">Hi,<br>
<br>
My understanding is passync intercepts the password before its
encrypted in AD</div>
</blockquote>
<br>
Yes.<br>
<br>
<blockquote
cite="mid:833D8E48405E064EBC54C84EC6B36E404CC90AF4@STAWINCOX10MBX1.staff.vuw.ac.nz"
type="cite">
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">and written to the AD's ldap db/disk</div>
</blockquote>
<br>
PassSync writes it to a log file on the windows machine, not to the
ldap db.<br>
<br>
<blockquote
cite="mid:833D8E48405E064EBC54C84EC6B36E404CC90AF4@STAWINCOX10MBX1.staff.vuw.ac.nz"
type="cite">
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">it cant be decrypted thereafter.</div>
</blockquote>
<br>
PassSync stores the password reversibly encrypted on the disk, so it
is safely stored, and can be converted back to cleartext to send to
IPA.<br>
<br>
<blockquote
cite="mid:833D8E48405E064EBC54C84EC6B36E404CC90AF4@STAWINCOX10MBX1.staff.vuw.ac.nz"
type="cite">
<div style="direction: ltr;font-family: Tahoma;color:
#000000;font-size: 10pt;">It then sends the plain text password
via an encrypted link to IPA, so its pretty safe. No there is no
easy way I know of, though its possible to use AD for Kerberos
ie password and an LDAP for control, dont think that is
practical in IPA.....but AD and say Openldap, yes. We have a
setup here, but ordinary bods like me couldnt maintain / modify
/ patch it.
<br>
<br>
The other possibility is Oracle's OVD which is an open virtual
directory that sits in front of (multiple if necessary) LDAPs
and gives a LDAPv3 output but that is expensive...ie when
oracle say "open" they mean open your wallet and we'll take all
we want...its also awful....2 of use tried for 3 weeks to make
it work and gave up, too unstable.<br>
<br>
The last way I know of, which we have is a web based application
called Psync which allows users to reset their own password via
a https web page that then injects into AD, it can do LDAPs as
well in parallel...but thats really the same thing as
passync....<br>
<br>
Or just use AD, then you use something like Centrify or Likewise
and that cost hurts as well. So depends who is paying....get
them to "chat" to your security group. Ours are A OK with
Passync as the gains of IPA and centralised control far outstrip
the Passsync minor concern. Besides which a decently sized and
complex AD is a swiss cheese for security anyway. Ask your
security how the last external pen test on AD went..if they have
never done one.....its a bit rich for them to comment on
Passync.....<br>
<br>
;]<br>
<br>
<div>regards
<div style="font-family: Tahoma; font-size: 13px;">
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0);
font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF935885"><font
color="#000000" face="Tahoma" size="2"><b>From:</b>
<a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>
[<a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] on behalf of Sylvain
Angers [<a class="moz-txt-link-abbreviated" href="mailto:sylvainangers@gmail.com">sylvainangers@gmail.com</a>]<br>
<b>Sent:</b> Thursday, 10 May 2012 6:19 a.m.<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<b>Subject:</b> [Freeipa-users] proxy with Active
Directory<br>
</font><br>
</div>
<div>
<div>Hello</div>
<div> </div>
<div>Our security group have concern with copying
username/password from from AD and might not allow this
synchronisation to even happen.</div>
<div>Is there a way to configure ipa to go get
username/password via kind of proxy?</div>
<div> </div>
<div>Thank you!<br clear="all">
<br>
-- <br>
Sylvain Angers<br>
<br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
</body>
</html>