I'm looking at altering some config of some Ubuntu machines that are using the SSSD package to bind to AD. As far as I understand, all ldap queries should be going through TSL from the config below.
Struggling to test this extensively as our live AD is pretty busy and hard to report against in real time. We only have vague reports that are harvested every few hours which still report my test machine as a problem.
I have been monitoring tcpdump there are still odd bits of information that are in clear text, but nothing sensitive just AD server locations and meta data being updated. It's seems to be just arbitrary information reporting ad servers when sssd.service is restarted.
If anyone can give any advice to ensure sssd with work against the up and coming Microsoft patch, I would be obviously very grateful.
[sssd] domains = example.com config_file_version = 2 services = nss, pam [domain/example.com] ad_domain = example.com krb5_realm = example.com realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash rdns = false dyndns_update_ptr = false use_fully_qualified_names = False #fallback_homedir = /home/%u@%d access_provider = ad override_homedir = /home/example/%u ad_gpo_map_permit = +polkit-1 dyndns_update = True default_domain_suffix = example.com ignore_group_members = True ldap_id_mapping = True ldap_access_filter = (objectClass=user) #ldap_uri = ldaps://example.com:636 ldap_uri = ldaps://example.com ldap_search_base = DC=example,DC=com # The file containing CA certificates you want sssd to trust. ldap_tls_cacert = /etc/pki/rootCA.pem # The TLS ciphers you wish to use. SSSD uses OpenSSL style cipher # suites ldap_tls_cipher_suite = HIGH ldap_sasl_mech = GSSAPI ldap_tls_reqcert = demand