Michael Ströder wrote:
Joshua Schaeffer wrote:
When I try to do any sort of ldap operation without the -ZZ option then slapd returns a "TLS confidentiality required" message as it should and as I expect. However, If I sniff the wire, I still see the attempted bind request with my DN and password in plaintext.
Is there any way to force clients to use start_tls without sending any credentials over the wire (a.k.a. return an error message before a bind request is actually submitted) or does this have to be controlled outside of OpenLDAP?
Simply use LDAPS (on separate port). It was never defined in a standard but most LDAP-enabled software supports it.
Or just use ldaps on the standard port 389. If you only want TLS-protected sessions there's no reason to support plaintext connections.
And no, there is no way for any setting on the server to prevent clients from contacting the server in whatever way they choose. If your clients default to sending in plaintext, you have to fix all of your clients.
No, unfortunately that was not taken into consideration when the LDAP v3 spec was written.
is a bit of a red herring. The basics of the Bind operation were defined back in the 1980s in X.500. For performance reasons the protocol is designed with a 1 message request -> 1 message response model. The only way to prevent a client from sending credentials in the clear would be to break the Bind request into two message exchanges. Instead of "I want to Bind as DN xxx with password yyy" -> <- "OK" you would have had to do something like "I want to Bind" -> <- "OK send me your credentials" "Here's my DN xxx and password yyy" -> <- "OK"
Taking twice as many messages would slow down authentication by 2x. Instead of pessimizing the common case the design assumes that competent administrators have set up both the clients and the servers.