Hello Ken, thanks for detailed analysis.
Marek Odoslané pomocou bezpečného emailu Proton Mail. piatok 17. apríla 2026, 18:49, Ken Hornstein <[email protected]> napísal/a: > >this seems usable. So I suppose when I set ldaps instead of > >ldap, kerberos should stop working until I set LDAPTLS_CACERT in > >/etc/sysconfig/krb5kdc right? (I am using Fedora 43.) > > I believe that is correct, yes, assuming it can't verify the certificate > using the OS certificate store. > > >The start_tls is not possible with MIT kerberos, right? > > Assuming you're using the OpenLDAP libraries, my reading of the > code is that if ldap_new_connection() sees that the server supports > start_tls then it will automatically attempt it. _However_ ... it > will not require that start_tls succeeds like the "-ZZ" option to > the command-line utilities. So you would be vulnerable to an active > downgrade attack by a rogue server. So I believe the answer is, "It > will probably work, but you shouldn't use it in this case". There does > not seem to be a client-side configuration setting that would enforce > the use of start_tls, which is kind of unfortunate. You can do that > on the _server_, but again doesn't help you with a rogue server and an > active downgrade attack. > > --Ken > ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
