Re: AD SSL, what impact?

We use external certs with our DCs and it isn't that big of a deal. You
just need a valid SSL cert registered to the DNS name of the DC and you are
good to go. Make sure you don't let them expire. :) I don't have any
experience with ECAs, so I assume they are easier still, but externally
sourced certs are definitely not rocket science.

For the presentation Ryan and I did at DEC, we got our test DC up and
running with SSL LDAP using a self-signed cert we generated with selfssl.exe
from the IIS 6 Resource Kit (free download) in less than 5 minutes. It was
not hard. The ADAM instance on my XP laptop is set up about the same way
and also works fine.

SSL LDAP traffic will naturally be a little slower than unencrypted traffic,
but the difference is probably neglible. I would not worry about that. Your
focus should be on security first.

If your app needs SSL, it is likely because it does simple LDAP binds
instead of SASL. If this is true, YOU MUST GET SSL!!!! Otherwise you'll
have plaintext credentials flying around on your network on unsecure
protocols. This is not good.

If your app uses Microsoft's LDAP APIs (LDAP, ADSI, .NET, etc.), then you
can use SASL binds with Windows authentication to protect the credentials
and can use built in SSPI channel encryption/signing to protect the network
traffic an ensure it has not been tampered with. This is often an
attractive option as it avoids having to deploy SSL. It doesn't work for
everyone though.

Also, if the app will doing LDAP-based password mods (changes and resets)
using ADSI SetPassword/ChangePassword, my experience is that you will get
maximum reliability with SSL available. The other techniques that those
methods use are (in my experience) not as reliable and much harder to
troubleshoot.

Best of luck!

Joe K.

"Paul Williams [MVP]" <ptw2001@xxxxxxxxxxx> wrote in message
news:OYJfM2aWGHA.3864@xxxxxxxxxxxxxxxxxxxxxxx
What's the problem with implementing an ECA? This is surprisingly simple,
easy to secure, and makes implementing SSL REALLY easy (you do nothing ;-)

You use 3rd-party certs and it might be a lot more work. Depends on
whether
you can use auto-enrolment.

Only caveat that I came across (in a quick and dirty CA rollout) was the
SP1
DCOM issue. But the read-me covers that (I just never bothered reading
the
read-me!).


And what kind of impact enabling SSL might have if we deploy it to the
DC's?

Nothing springs to mind. It just means that you can now implement simple
binds in a safe and secure manner - which a lot of LDAP apps will want to
do.

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net




.

Relevant Pages

  • Re: How to add an extra password field to an AD?
    ... bind operation, so you cannot do what you want to do anyway, assuming that the device in question uses a standard LDAP bind to do LDAP authentication. ... SSL cannot be used here since the protocol being used does not have an SSL variant. ... My concern is not the LDAP traffic between the service server and the LDAP server, it is between service client and service server. ... I actually don't want the app to see AD passwords that give access to Windowws resources. ...
    (microsoft.public.windows.server.active_directory)
  • Re: LDAP authentication security ?
    ... I'm actually a big fan of external SSL certs for DCs simply because they are ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... Actually we don't have any PKI so we will buy a commercial SSL ... Simple bind is the authentication mechanism in the LDAP V3 spec and is ...
    (microsoft.public.windows.server.security)
  • Re: [opensuse] Help with Certs for Cyrus IMAP and TLS
    ... Ok, I changed the certs permissions to read/write by root only, no others can read. ... I re-made the certs again using a different how-to, making sure they did not require a pass phrase, but that did not fix the problem either. ... One, I had to start cyrus in runlevel editor and second, my IMAP SSL was and is now broken. ...
    (SuSE)
  • Re: enable LDAP-SSL without a root-CA
    ... DC's for secure SSL password changes from UNIX sources and we don't use MS ... something from verisign. ... I said we wouldn't do it, if they needed Certs for the DC's they ...
    (microsoft.public.win2000.security)
  • Re: Muliple Websites on Mutliple IP address with certicles [SSL]
    ... As opposed to different domains altogether ... IE6 caching SSL information in the past, but only when using a different ... whichever connection was made first eg. SSL on port 443 running IIS, ... compared to my current setup of 3 certs for completely different hostnames. ...
    (microsoft.public.inetserver.iis.security)