<div dir="ltr">Thanks for the quick responses, you have both answered everything I was looking for!</div><div class="gmail_extra"> <div class="gmail_quote">On Tue, Mar 29, 2016 at 9:48 AM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 29 Mar 2016, Simo Sorce wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Tue, 2016-03-29 at 08:51 -0600, Master P. wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hello, I am using FreeIPA on the cloud and am worried about MITM attacks. I'm assuming all network traffic can be easily read and possibly manipulated by an attacker. When following <a href="https://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html" rel="noreferrer" target="_blank">https://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html</a>, some of the listed ports for FreeIPA (80 and 389) are unencrypted ports. </blockquote> The only thing port 80 does is redirect to 443. </blockquote> There is also a CA certificate access on port 80 in case LDAP-based access didn't work. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Port 389 is the only use LDAP port and clients will use the STARTTLS command to transition to to a TLS encrypted connection or use GSSAPI and confidentiality to encrypt the traffic. </blockquote> Also, any LDAP BIND with password will be refused without STARTTLS command. -- / Alexander Bokovoy </blockquote></div> </div>