[Samba] Samba 4.2.x requiring TLS authentication

[Felipe Izaguirre]

Hi everyone,

I have installed a Samba AD DC version 4.2.11-20 in a Centos 6.7 machine
and joined it in an existing domain. Everything seems working fine except I
can't bind to it using LDAP simple authentication. When I try to perform a
simple ldapsearch I get the following response:

ldap_bind: Strong(er) authentication required (8)
additional info: BindSimple: Transport encryption required.

That is weird as I have not set the certificates and haven't had configured
nothing to use LDAPS. Looking in the documentation it says that by default
Samba 4 does not use LDAPS and to configure it you need to provide the
certificates.
So, why is this DC is asking me to use LDAPS? Is there some samba-tool
command I can run to debug or some hidden option to disable it?

I really appreciate any help you can provide.



Felipe Izaguirre
*Computer Scientist Student and Sysadmin*

[Kris Lou]

As of 4.2.11: https://www.samba.org/samba/security/CVE-2016-2112.html

===================
New smb.conf option
===================

ldap server require strong auth (G)

The ldap server require strong auth defines whether the
ldap server requires ldap traffic to be signed or
signed and encrypted (sealed). Possible values are no,
allow_sasl_over_tls and yes.

A value of no allows simple and sasl binds over all transports.

A value of allow_sasl_over_tls allows simple and sasl binds
(without sign or seal)
over TLS encrypted connections. Unencrypted connections only
allow sasl binds with sign or seal.

A value of yes allows only simple binds over TLS encrypted connections.
Unencrypted connections only allow sasl binds with sign or seal.

Default: ldap server require strong auth = yes


In short, "ldap server require strong auth = no"


Kris Lou
***@themusiclink.net

[mathias dufresne]

IMHO, in short, learn to use encrypted connections.

Post by Kris Lou
As of 4.2.11: https://www.samba.org/samba/security/CVE-2016-2112.html
===================
New smb.conf option
===================
ldap server require strong auth (G)
The ldap server require strong auth defines whether the
ldap server requires ldap traffic to be signed or
signed and encrypted (sealed). Possible values are no,
allow_sasl_over_tls and yes.
A value of no allows simple and sasl binds over all transports.
A value of allow_sasl_over_tls allows simple and sasl binds
(without sign or seal)
over TLS encrypted connections. Unencrypted connections only
allow sasl binds with sign or seal.
A value of yes allows only simple binds over TLS encrypted connections.
Unencrypted connections only allow sasl binds with sign or seal.
Default: ldap server require strong auth = yes
In short, "ldap server require strong auth = no"
Kris Lou
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Felipe Izaguirre]

Thank you guys, I've missed this info for the latest versions.

Felipe Izaguirre
*Computer Scientist Student and Sysadmin*

Post by mathias dufresne
IMHO, in short, learn to use encrypted connections.

Post by Kris Lou
As of 4.2.11: https://www.samba.org/samba/security/CVE-2016-2112.html
===================
New smb.conf option
===================
ldap server require strong auth (G)
The ldap server require strong auth defines whether the
ldap server requires ldap traffic to be signed or
signed and encrypted (sealed). Possible values are no,
allow_sasl_over_tls and yes.
A value of no allows simple and sasl binds over all transports.
A value of allow_sasl_over_tls allows simple and sasl binds
(without sign or seal)
over TLS encrypted connections. Unencrypted connections only
allow sasl binds with sign or seal.
A value of yes allows only simple binds over TLS encrypted

connections.

Post by Kris Lou
Unencrypted connections only allow sasl binds with sign or seal.
Default: ldap server require strong auth = yes
In short, "ldap server require strong auth = no"
Kris Lou
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba