Hello. I've configured domain membership for one linux server, and now I'm trying to understand one thing. I can't figure out how SASL-GSSAPI encrypts LDAP requests and GC interactions. As long as I understood Kerberos, it's a protocol solely for authentication, and SASL-GSSAPI gives it ability to encrypt all data transactions between authenticated hosts. But this encryption is not mandatory. I've done several queries via 'id' utility to generate traffic, and captured it. All I can see is LDAP traffic to 389/tcp and 3268/tcp, which is encrypted. I can decrypt it by loading host's keytab to Wireshark. We've disabled anonymous and insecure binds (without integrity checking or SSL/TLS encryption) in AD, and didn't adjust minssf/maxssf parameters on Linux. As long as I understood, AD does not require whole session encryption, neither does Linux. All authentication is done in SSSD (authconfig --enablesssd --enablesssdauth). To summarize: I want to understand, why SASL-GSSAPI encrypts whole connection and not just auth phase, so I could be sure that one day all connections wouldn't appear in plaintext on the network. If I had more experience in programming, I've could find the answer in source code (all hail to opensource) to fullfill my curiosity, but unfortunately I can't do that, so I'll appreciate any help/hints/links on the topic. Kind regards. _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Dmitri Pal писал 2015-08-29 01:35: >On 08/28/2015 06:25 PM, l(a)avc.su wrote: >>Hello. >> >>I've configured domain membership for one linux server, and now I'm >>trying to understand one thing. I can't figure out how SASL-GSSAPI >>encrypts LDAP requests and GC interactions. As long as I understood >>Kerberos, it's a protocol solely for authentication, and SASL-GSSAPI >>gives it ability to encrypt all data transactions between >>authenticated hosts. But this encryption is not mandatory. >>I've done several queries via 'id' utility to generate traffic, and >>captured it. All I can see is LDAP traffic to 389/tcp and 3268/tcp, >>which is encrypted. I can decrypt it by loading host's keytab to >>Wireshark. >>We've disabled anonymous and insecure binds (without integrity >>checking or SSL/TLS encryption) in AD, and didn't adjust minssf/maxssf >>parameters on Linux. As long as I understood, AD does not require >>whole session encryption, neither does Linux. >>All authentication is done in SSSD (authconfig --enablesssd >>--enablesssdauth). >> >>To summarize: I want to understand, why SASL-GSSAPI encrypts whole >>connection and not just auth phase, so I could be sure that one day >>all connections wouldn't appear in plaintext on the network. >>If I had more experience in programming, I've could find the answer in >>source code (all hail to opensource) to fullfill my curiosity, but >>unfortunately I can't do that, so I'll appreciate any help/hints/links >>on the topic. >> >>Kind regards. >>_______________________________________________ >>sssd-users mailing list >>sssd-users(a)lists.fedorahosted.org >>https://lists.fedorahosted.org/mailman/listinfo/sssd-users > >GSSAPI supports both authentication and encryption. It is a part of the >standard. >Please check GSSAPI documentation for more details. >It is unfortunate that not many people use this encryption capability >and know about it. >Leveraging this encyption for the whole session allows avoiding use of >the TLS for session confidentiality which requires additional overhead >in dealing with certificates when there is really no need to do so. >As it is a part of standard, I do not see a reason why suddenly your >traffic would become plain text ever. Hi Dmitri. I've got couple of evenings to follow your advice, and I have interesting results. First of all, I've found out how SASL negotiates security of the context. In short: http://docs.oracle.com/cd/E19120-01/open.solaris/819-2145/sasl.intro-44/i... (just picks the max value both side can use) This bothered me the most, cause I need to understand how can I disable 'switching to plain' accidentally or on purpose. And it really could happen if someone set 'maxssf=1' in ldap.conf, so I just need to specify ldap_sasl_minssf=56 in sssd.conf, or SASL_SECPROPS minssf=56 in ldap.conf.

Although I havent found any 'system-wide' setting for SASL, I still can configure it per-application. Thank you for good responce and pointing me to right direction. Here's couple of links that I found useful: http://tools.ietf.org/html/rfc2743 http://cyrusimap.org/docs/cyrus-sasl/2.1.23/gssapi.php http://docs.oracle.com/javase/jndi/tutorial/ldap/security/sasl.html _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users