[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Disallow ldap operations without start_tls
Michael Ströder wrote:
Joshua Schaeffer wrote:
When I try to do any sort of ldap operation without the -ZZ option then slapd
returns a "TLS confidentiality required" message as it should and as I expect.
However, If I sniff the wire, I still see the attempted bind request with my DN
and password in plaintext.
Is there any way to force clients to use start_tls without sending any
credentials over the wire (a.k.a. return an error message before a bind request
is actually submitted) or does this have to be controlled outside of OpenLDAP?
Simply use LDAPS (on separate port). It was never defined in a standard but most
LDAP-enabled software supports it.
Or just use ldaps on the standard port 389. If you only want TLS-protected
sessions there's no reason to support plaintext connections.
And no, there is no way for any setting on the server to prevent clients from
contacting the server in whatever way they choose. If your clients default to
sending in plaintext, you have to fix all of your clients.
Quanah's comment:
No, unfortunately that was not taken into consideration when the LDAP v3 spec was written.
is a bit of a red herring. The basics of the Bind operation were defined back
in the 1980s in X.500. For performance reasons the protocol is designed with a
1 message request -> 1 message response model. The only way to prevent a
client from sending credentials in the clear would be to break the Bind
request into two message exchanges. Instead of
"I want to Bind as DN xxx with password yyy" ->
<- "OK"
you would have had to do something like
"I want to Bind" ->
<- "OK send me your credentials"
"Here's my DN xxx and password yyy" ->
<- "OK"
Taking twice as many messages would slow down authentication by 2x. Instead of
pessimizing the common case the design assumes that competent administrators
have set up both the clients and the servers.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/