<div><div dir="auto">Fyi looks like MS have pushed this back to second 1/2 of year</div></div><div dir="auto"><div><a href="https://isc.sans.edu/forums/diary/Authmageddon+deferred+but+not+averted+Microsoft+LDAP+Changes+now+slated+for+Q3Q4+2020/25800/">https://isc.sans.edu/forums/diary/Authmageddon+deferred+but+not+averted+Microsoft+LDAP+Changes+now+slated+for+Q3Q4+2020/25800/</a></div><br></div><div dir="auto"><br></div><div dir="auto">Martin</div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 13 Feb 2020 at 22:38, Scott Silva via ZendTo <<a href="mailto:zendto@zend.to">zendto@zend.to</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ran openssl s_client -connect <a href="http://your-AD-server-here.example.com:636" rel="noreferrer" target="_blank">your-AD-server-here.example.com:636</a> (fixing actual name)<br>
On my spamfilter linux box that DOES work I see a bunch of root certificates loaded on the system...<br>
I wonder if that is one of the issues it doesn't seem to work on the CentOS Zendto box<br>
The working system is Debian I believe...<br>
<br>
<br>
<br>
From: ZendTo <<a href="mailto:zendto-bounces@zend.to" target="_blank">zendto-bounces@zend.to</a>> On Behalf Of Jules Field via ZendTo<br>
Sent: Wednesday, February 12, 2020 7:24 AM<br>
To: ZendTo Users <<a href="mailto:zendto@zend.to" target="_blank">zendto@zend.to</a>><br>
Cc: Jules Field <Jules@Zend.To><br>
Subject: Re: [ZendTo] News — Microsoft enforcing LDAPS for AD servers<br>
<br>
Karl,<br>
<br>
Given that it was a could-not-connect-at-all issue, then it's most likely either<br>
a) incoming firewall on the AD server not listening on the correct LDAPS ports (636/tcp IIRC),<br>
or<br>
b) the SSL/TLS handshake between the ZendTo server and the AD Server is failing. This is most often caused by people using locally-signed certs on their AD servers, at which point the ZendTo server will need to be given a copy of the Root CA cert for your locally-signed certs. Just like you would need to give it to a web browser in order to avoid the errors when you browse to a website which is signed with a locally-signed cert.<br>
<br>
A good command to test the SSL/TLS handshake from your ZendTo server is this:<br>
<br>
openssl s_client -connect <a href="http://your-AD-server-here.example.com:636" rel="noreferrer" target="_blank">your-AD-server-here.example.com:636</a><br>
<br>
That should print out all sorts of nice looking things and not any error messages. When it's stopped outputting, just Ctrl-C it.<br>
<br>
Cheers,<br>
Jules.<br>
On 10/02/2020 17:47, Karl Bundy via ZendTo wrote:<br>
I also am running RedHat7/CentOS7 and having the same issue. Nothing seems to output any helpful logs to help troubleshoot the source of the issue (cert issue, missing packages, etc.) Any suggestions would be appreciated!<br>
<br>
Thanks,<br>
<br>
Karl Bundy<br>
<br>
-----Original Message-----<br>
From: ZendTo [mailto:<a href="mailto:zendto-bounces@zend.to" target="_blank">zendto-bounces@zend.to</a>] On Behalf Of Scott Silva via ZendTo<br>
Sent: Monday, February 10, 2020 10:38 AM<br>
To: 'ZendTo Users' mailto:<a href="mailto:zendto@zend.to" target="_blank">zendto@zend.to</a><br>
Cc: Scott Silva mailto:<a href="mailto:ssilva@sgvwater.com" target="_blank">ssilva@sgvwater.com</a><br>
Subject: Re: [ZendTo] News — Microsoft enforcing LDAPS for AD servers<br>
<br>
Running on Redhat 7<br>
<br>
Made changes to /etc/openldap/ldap.conf<br>
Made changes to preferences.php<br>
Get login error<br>
LDAP Error<br>
Check User: Unable to connect to any of the authentication servers; could not authenticate user. Please notify the system administrator.<br>
Authentication Error<br>
The username or password was incorrect.<br>
Found I did not have gnutls installed, and thought it might be required. Not sure how else to test...<br>
Maybe a list of packages that might be required?<br>
<br>
<br>
<br>
From: ZendTo mailto:<a href="mailto:zendto-bounces@zend.to" target="_blank">zendto-bounces@zend.to</a> On Behalf Of Jules via ZendTo<br>
Sent: Saturday, February 8, 2020 9:29 AM<br>
To: ZendTo Users mailto:<a href="mailto:zendto@zend.to" target="_blank">zendto@zend.to</a><br>
Cc: Jules mailto:<a href="mailto:Jules@Zend.To" target="_blank">Jules@Zend.To</a><br>
Subject: [ZendTo] News — Microsoft enforcing LDAPS for AD servers<br>
<br>
Microsoft are about to enforce the use of LDAPS (removing unencrypted LDAP) when checking user credentials against an AD server.<br>
<br>
This needs a couple of minor changes to your ZendTo server.<br>
<br>
I have written up some simple instructions here<br>
<a href="https://zend.to/activedirectory.php" rel="noreferrer" target="_blank">https://zend.to/activedirectory.php</a><br>
which certainly appear to work for me.<br>
<br>
I strongly advise you make the changes and test the resulting service before Microsoft release the patch that enforces the need for this. It should cause no harm except to improve the security of communications between ZendTo and your AD server.<br>
<br>
Any comments / problems / questions, please do let me know straightaway!<br>
<br>
Cheers,<br>
<br>
Jules<br>
<br>
--<br>
Julian Field MEng CEng CITP MBCS MIEEE MACM<br>
<br>
The current UK shipping forecast:<br>
Irish Sea: Southwest 4 or 5, becoming cyclonic 6 to gale 8, then north 4 to 6.<br>
Slight or moderate, occasionally rough in south. Rain. Good, occasionally poor.<br>
<br>
<a href="http://www.Zend.To" rel="noreferrer" target="_blank">http://www.Zend.To</a><br>
Twitter: @JulesFM<br>
_______________________________________________<br>
ZendTo mailing list<br>
mailto:<a href="mailto:ZendTo@zend.to" target="_blank">ZendTo@zend.to</a><br>
<a href="http://jul.es/mailman/listinfo/zendto" rel="noreferrer" target="_blank">http://jul.es/mailman/listinfo/zendto</a><br>
_______________________________________________<br>
ZendTo mailing list<br>
mailto:<a href="mailto:ZendTo@zend.to" target="_blank">ZendTo@zend.to</a><br>
<a href="http://jul.es/mailman/listinfo/zendto" rel="noreferrer" target="_blank">http://jul.es/mailman/listinfo/zendto</a><br>
<br>
<br>
Jules<br>
<br>
-- <br>
Julian Field MEng CEng CITP MBCS MIEEE MACM<br>
<br>
'A good programmer is someone who always looks both ways<br>
before crossing a one-way street.' - Doug Linder<br>
<br>
<a href="http://www.Zend.To" rel="noreferrer" target="_blank">http://www.Zend.To</a><br>
Twitter: @JulesFM<br>
_______________________________________________<br>
ZendTo mailing list<br>
<a href="mailto:ZendTo@zend.to" target="_blank">ZendTo@zend.to</a><br>
<a href="http://jul.es/mailman/listinfo/zendto" rel="noreferrer" target="_blank">http://jul.es/mailman/listinfo/zendto</a><br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">-- <br>Martin Hepworth, CISSP<br>Oxford, UK</div>