This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
LDAP Signing
LDAP Signing

Version management

Difference between version and

At line 1 added 53 lines
!!! Overview
[{$pagename}] is a concept within [Microsoft Windows] during [LDAP] [Bind Request] for providing [Integrity] validation and is part [ADV190023] and [LDAPServerIntegrity]
!! [{$pagename}] using [SASL]
This appears to be [Microsoft Windows] specific where all [communications] between [client] and [Server] will be [Digitally Signed] providing [Integrity] validation.
For [LDAP] [Clients] this is done using:
* The [signing key] is derived from the [authenticating|authentication] [Digital Identity]'s [Password-hash]
* The [client] calculates the [session Key]
* The [server] receives the [Session Key] from the [Domain Controller] in the [Netlogon service] [response]
An [Man-In-The-Middle] [attacker] with [Replay attack] capabilities has no way of retrieving the [session Key] and therefore will not be able to provide [Digitally Signed] [messages]
!! [Kerberos]
For [implementations] using [SPNEGO] or [GSSAPI], the [client] preforms the [Encryption] of the payload using a [Kerberos] [Session Key] before sending over the wire to [Microsoft Active Directory].
!! [LDAPS] and [StartTLS] [{$pagename}]
[Integrity] validation is part of the [Transport Layer Security] ([TLS]) protocol and is considered acceptable by [Microsoft Active Directory] as [{$pagename}]
!! Failed LDAP [Bind Request]
Windows [Domain Controllers] will return an event when [{$pagename}] is required and not used by the client on a NON-[Transport Layer Security] ([TLS]) connection similar to:
{{{LDAP error code 8 - server log [LDAP: error code 8 - 00002028: LdapErr: DSID-0C090202, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v2580 ]
}}}
Most Client should show a [LDAP Result Codes] of 8 indicating [LDAP_STRONG_AUTH_REQUIRED].
!! [{$pagename}] [Domain Controller] [Windows registry]
[HKEY_LOCAL_MACHINE]\SYSTEM\CurrentControlSet\Services\NTDS\Parameters under the value [LDAPServerIntegrity] (LDAPClientIntegrity for Clients):
* 0 - No signing/sealing
* 1 - Negotiate signing/sealing
* 2 - Require signing/sealing (Which is the advice of [ADV190023])
!! Configure [Microsoft Active Directory] and [AD LDS] diagnostic event [logging]
[LDAP] [Windows Security Log|Windows Security Log Event#section-Windows+Security+Log+Event-LDAPMicrosoftActiveDirectoryAndLDSDiagnosticEventLogging] must be at level 2 or higher to reveal these events:
There are several [Windows Security Log Events] to help indicate the status of implementation for [{$pagename}]:
* [Event 2886]
* [Event 2887]
* [Event 2888]
* [Event 2889]
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Event ID 2886 — LDAP signing|https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941856(v=ws.10)?redirectedfrom=MSDN|target='_blank'] - based on information obtained 2020-01-18
* [#2] - [LDAP signing|https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941832(v=ws.10)?redirectedfrom=MSDN|target='_blank'] - based on information obtained 2020-01-18
* [#3] - [Identifying Clear Text LDAP binds to your DC's|https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs|target='_blank'] - based on information obtained 2020-01-18
* [#4] - [Query-InsecureLDAPBinds.ps1|https://github.com/russelltomkins/Active-Directory/blob/master/Query-InsecureLDAPBinds.ps1|target='_blank'] - based on information obtained 2020-01-18
* [#5] - [LDAP Signing Events Custom View.xml|https://github.com/russelltomkins/Active-Directory/blob/master/LDAP%20Signing%20Events%20Custom%20View.xml|target='_blank'] - based on information obtained 2020-01-18
* [#6] - [The current Client Signing setting is maintained in the registry (of course) in the key|https://blog.joeware.net/2018/07/07/5842/|target='_blank'] - based on information obtained 2020-01-22
* [#7] - [How to enable LDAP signing in Windows Server|Wikipedia:https://support.microsoft.com/en-us/help/935834/how-to-enable-ldap-signing-in-windows-server-2008|target='_blank'] - based on information obtained 2020-01-22
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop