Zhang Weiwu writes: > /etc/services, it seems LDAP sits on 386 and LDAP with SSL sits on 636.
389, not 386. > Both Outlook and Evolution do not change port automatically from 386 > to 636 when checked SSL option, and they do seems to be suggesting > SSLed LDAP can also sits on 386 port. There are two ways to invoke LDAP over SSL (alias TLS): Connect to the ldap:// port and send the StartTLS LDAP request, or connect to the ldaps:// port which starts off in TLS mode and must not receive a StartTLS request. If Outlook and Evolution do not change the port when you specify SSL, hopefully they use the former method. Some clients do stupid things about that though. For example I just saw one which deduces the URL scheme (ldap or ldaps) from the port number, instead of the default port number from the URL scheme. ldap and ldaps are different protocols: One starts off talking LDAP at the outer level and the other starts off with TLS. So the ldap:// port will not understand a client which tries to talk 'ldaps' and the ldaps:// port will not understand one which tries to talk 'ldap'. At least not unless the server has some magic to discover when the user makes that mistake. > We wish to only provide customers with SSL connections. What is the > best practise? Should we block port 386 and ask LDAP server to listen > on port 636 only, or should we ask the server to listen on 386 but > only accept SSLed connection? If both are fine, we prefer to use 386 > port because that save one step of operation for Outlook users, that > is a big help to them actually because a lot of users dislike > configuring. ldaps:// is nonstandard but oldest, so maybe it is best supported by clients. ldap:// + StartTLS is the standard and recommended way. If the server allows it you could listen to both, and require TLS. With OpenLDAP you put something like security tls=128 ssf=128 in slapd.conf and start slapd with slapd -h 'ldap:// ldaps://' I don't know how to do it with other servers. -- Hallvard --- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
