samba - Aug 2005 - Question about SSL/TLS for ldap and samba

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I read in samba-howto-collection :

"To remedy the first security issue, the ldap ssl |smb.conf| parameter
defaults to require an encrypted session (ldap ssl = on) using the
default port of |636| when contacting the directory server. When using
an OpenLDAP server, it is possible to use the StartTLS LDAP extended
operation in the place of LDAPS. In either case, you are strongly
encouraged to use secure communications protocols (so do not set ldap
ssl = off).

 Note that the LDAPS protocol is deprecated in favor of the LDAPv3
StartTLS extended operation. However, the OpenLDAP library still
provides support for the older method of securing communication
between clients and servers."

What is the difference between LDAPs and ldapv3 start-tls ?

I select the ldaps protocol in my smb.conf because I don't kown how
samba manage certificate.
If samba can use a certficate, it's not a problem.  But I think that
samba use the certificate used with openLDAP client.

If is exact can I suggest to add some parameter in smb.cobnf for
specify certificate for samba only.

thanks

    St?phane Purnelle

- --
St?phane Purnelle <stephane.purnelle@tiscali.be>
Site Web : http://www.linuxplusvalue.be
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC9e448tswkE3d0ecRApH5AJ4hSwi35mhk2yUN3EMInGn1bkM8sACgi1hp
OOhLAtItrA1uOZMSS92IVnc=WsnN
-----END PGP SIGNATURE-----

> What is the difference between LDAPs and ldapv3 start-tls ?
ldaps listens on port 636 and start-tls is used on the standard 389 ldap
port.
> I select the ldaps protocol in my smb.conf because I don't kown how
> samba manage certificate.
I would use:

ldap ssl = start_tls
> If samba can use a certficate, it's not a problem.  But I think that
> samba use the certificate used with openLDAP client.
Samba looks at the standard system ldap.conf, which is in
/etc/openldap/ldap.conf

You can tell OpenLDAP to only allow TLS connections via the "security"
setting.

See man slapd.conf

Gavin.

-- 
Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 742001
E ghenry@suretecsystems.com

Open Source. Open Solutions(tm).

http://www.suretecsystems.com/