Replies: 15 comments
-
|
Added @bhallasaksham |
Beta Was this translation helpful? Give feedback.
-
|
Added @smhmhmd |
Beta Was this translation helpful? Give feedback.
-
|
Added @muskanlalit18 |
Beta Was this translation helpful? Give feedback.
-
|
Hopefully the utility is no longer in use. |
Beta Was this translation helpful? Give feedback.
-
|
Channel signing /etc/ldap/ldap.conf: from the repository root: |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for reaching out to us @3BK. Team is currently investigating and we'll get back to you once we have more information. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
@3BK |
Beta Was this translation helpful? Give feedback.
-
|
>Do we need LDAP over Kerberos over SSL ?
Good question. I would ask:
- Jeffrey Altman, Secure Endpoints Inc.
- Nicolas Williams, Two Sigma Solutions (Oracle)
- Larry Zhu, Atlassian (Microsoft)
My gut feeling is that they would say yes, absolutely.
To phrase it another way, it depends on the {WHO, WHAT, WHEN, WHERE} tuple which you insert in place of the label "we" in your above question.
There are at least three flavors of channel binding:
- tls-exporter (tls1.3)
- tls-unique (tls1.2)
- tls-server-end-point (legacy)
|
Beta Was this translation helpful? Give feedback.
-
|
Ok, this issue is an enhancement not a security vulnerability. Is this okay with you ? Thanks for filing the issue, by the way. |
Beta Was this translation helpful? Give feedback.
-
|
We would love to have a meeting with you, please email samiull at amazon dot com |
Beta Was this translation helpful? Give feedback.
-
|
Assuming the typical use case for a GMSA fetcher in AWS is an enterprise or industrial/manufacturing business unit - not a commercial or retail customer. (I.e. an educated customer.) And given that channel binding has been in the public domain for at least 15 years. And, if we were to squint real hard, then yes channel binding is an enhancement.
Still, I would add a note saying that this fetcher, with its naked ldap call, is a solution template. It is best paired with an AWS site-to-site VPN tunnel. Customers with end-to-end privacy requirements such as ATO/ Fed ramp, health care, PCIDSS, etc. should review and tailor the template. For example, by adding channel signing, or channel binding.
|
Beta Was this translation helpful? Give feedback.
-
No issues. Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Background reading:
|
Beta Was this translation helpful? Give feedback.
-
|
I confirm, Channel Binding support is very important! @3BK has already given good links! It is linked to SCRAM-SHA-X-PLUS variant in more SCRAM-SHA-X: Salted Challenge Response Authentication Mechanism (SCRAM) is important too, better than old and unsecure mechanisms. Can you add the support of RFC 9266: Channel Bindings for TLS 1.3? Channel Bindings for TLS: https://datatracker.ietf.org/doc/html/rfc5929
Little details, to know easily:
I think that you have seen the jabber.ru MITM and Channel Binding is the solution:
Thanks in advance. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I'm sure you know but just in case, there is a 50+% chance that the execute_ldapsearch() method in /common/util.hpp is not using channel binding.
https://support.microsoft.com/en-us/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a
Beta Was this translation helpful? Give feedback.
All reactions