Use TLS for TACACS authentication against AD

[Zapino]

Hello Guys,

Is possible to use TLS encryption between TACACS and AD ? , AD admin provided me Root and Subordinate Certificate Authority, need to find a way how to make that work together.

Thank you very much for any advice

[Zapino]

In one conversation Marc mentioned, "USE_TLS triggers use of STARTTLS which will upgrade an unencrypted LDAP connection to an encrypted one." Then how make STARTTLS use "provided by AD admin certificate " with TLS ?

[Marc Huber]

On 01.02.21 04:44, Zapino wrote:
> In one conversation Marc mentioned, "USE_TLS triggers use of STARTTLS
> which will upgrade an unencrypted LDAP connection to an encrypted
> one." Then how make STARTTLS use "provided by AD admin certificate "
> with TLS ?

I don't think Windows supports STARTTLS for LDAP. Both

setenv LDAP_HOSTS = "ldaps://<ip>:636"

and

setenv LDAP_HOSTS = "ldaps://<ip>:3269"

should work.

The backend script doesn't verify the server cert so you likely won't
need the CA certificates provided by your admin.

Cheers,

Marc

[Zapino]

Yeah, I see with tcpdump the session is on port 636 and with OpenSSL command  + server IP where AD is configured give me certificate details TLS 1.2 , seems session to be encrypted. Thank you very much Marc for you help