Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Subject: Re: StartTLS enforced
To: users@directory.apache.org
References: 
 <678353651.15690933.1456414417251.JavaMail.yahoo.ref@mail.yahoo.com>
 <678353651.15690933.1456414417251.JavaMail.yahoo@mail.yahoo.com>
 <56CF322C.2050603@gmail.com> <56CF77C4.1030302@stefan-seelmann.de>
From: =?UTF-8?Q?Emmanuel_L=c3=a9charny?= <elecharny@gmail.com>
Message-ID: <56CF9498.2060800@gmail.com>
Date: Fri, 26 Feb 2016 00:56:08 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <56CF77C4.1030302@stefan-seelmann.de>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Le 25/02/16 22:53, Stefan Seelmann a =C3=A9crit :
> On 02/25/2016 05:56 PM, Emmanuel L=C3=A9charny wrote:
>> Le 25/02/16 16:33, s_humbi a =C3=A9crit :
>>> Hello,does anybody know, if there is a way to force the ldap-client t=
o use StartTLS ? I dont wont to offer our ldap-clients an unsecure way to=
 talk with our LDAP-Server.
>>> Yes I can disable the default-Port 389 and only enable the SSL-Port 6=
36.But there is written in the DS documentation: " **LDAPS** is considere=
d as deprecated. You should always favor startTLS instead. "
>>> And I also need the port 389 (with StartTLS) for replication, so i ca=
n not disable it.
>>> At the moment i use onlyTLSV1.2 (attribute ads-enabledProtocols). But=
 the users can still connect without TLS.
>>> I found this interesting paper:
>>> http://people.apache.org/~elecharny/ldapcon/Andrew%20Findlay-paper.pd=
f--> see Caption caption:  "The correct and standard approach is to start=
 LDAP without encryption and then negotiate the TLS security layer. If ne=
cessary, the server can be configured to refuse all operations other than=
 'Start TLS' until TLS is in place"
>>>
>> No, sorry, we can't enforce that atm. At least, here is no way to do
>> that through configuration.
>>
>> And yes, this is missing. In OpenLDAP, you can enforce TLS through som=
e
>> parameter, and I think that would be a good addition to ApacheDS.
>> Would you fancy creating a JIRA with such a demand ?
> But that cannot prevent the client from sending a request, e.g. a simpl=
e
> bind with plain text password, right?=20
It will. Check on http://www.openldap.org/doc/admin24/security.html,
par.14.2.1. Setting the 'security' parameter to a value > 1 will reject
any non-encrypted connection.


> Even if the server then refuses
> the operation, the password was sent over the wire. Would it then be
> appropriate to lock the account automatically?
You won't be able to send a request in clear text, AFAIU.