samba - Nov 2021 - questions about ports

Hello:
We are running vulnerability analysis on samba4 AD and I have several 
doubts:

1- The LDAP port(389) is obviously not encrypted, I was looking for 
information about the possibility of disabling it on the internal 
network(the workstation network), but I read on several sites that this 
is not suitable. Can I force all the LDAP communication against the 
servers to be LDAPS?

2- The LDAPS(636) port by default supports deprecated TLS versions 
(TLSv1.0 and TLSv1.1), my samba AD version is 4.13.7. I am looking in 
the Samba documentation and I did not find how to disable a specific TLS 
version. It's this possible, to disable an specific TLS version?

3- The Global Catalog port (3268), Can I disable it? Are there 
communications that cannot be encrypted by the 3269 and I must leave 
enabled the 3268 port?

4- Same query as in point 2, but with The Global Catalog SSL port 
(3269), I suppose that if there is a configuration to define the TLS 
versions it will affect both ports.
Regards

Marcos Ariel Negrini

On Thu, 2021-11-25 at 17:02 -0300, Marcos Ariel Negrini via samba
wrote:
> 
> 1- The LDAP port(389) is obviously not encrypted, I was looking for 
> 
> information about the possibility of disabling it on the internal 
> 
> network(the workstation network), but I read on several sites that
> this 
> 
> is not suitable. Can I force all the LDAP communication against the 
> 
> servers to be LDAPS?
You don't want that.  LDAPS is actually less secure, you want LDAP
(389) with SASL/GSSAPI/Kerberos encryption. 

Blocking 389 will break everything.  LDAPS is only helpful for the
simple bind case, where that is better than plaintext.

See 'ldap server require strong auth' for some details, but in short
because Samba doesn't implement the channel bindings for LDAPS, and
unless all clients send them, NTLM/Kerberos over LDAPS is vulnerable to
relay attacks. 

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions