HAP+ Unsecure LDAP binding might be an issue

[dezza]

Hi Everyone,

 

I've just learnt that Microsoft plan to disable unsecure/unsigned LDAP bindings/connections in March, you can read about it in this article here.

https://msandbu.org/upcoming-change-microsoft-to-disable-use-of-unsigned-ldap-port-389/

 

You can use this method to trace which devices/services on your network might be using LDAP.

https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs

 

I've been investigating my network and I believe Home Access Plus (HAP+) is using LDAP unsecured and so I'm concerned it may stop working with a future server update?

 

Does anyone know what can be done about this? I'd rather not have to find an alternative to HAP+.

 

Please excuse my knowledge on LDAP, it is limited

 

Thankyou for any help you can provide!

 

Derek

Edited January 28, 2020 by dezza

[RLR]

I can't help with OPs issue but I can post a link that will more help on identifying insecure ldap binds:

[3s-gtech]

You may need to change some of the core HAP+ code, if possible. It may be that the LDAP bind settings are in the config files (and it'd be a lot easier if they are). From experience with our own web-based CMS/MIS, I've had to go through and change the LDAP binds to LDAPS. I'm not 100% whether I've done it right, and testing will mean breaking it!

[synaesthesia]

A good question, surely it's just line 3 in hapconfig.xml?

 

"secureldap="True" ?

 

Edit - just tested, this works as expected.

Edited January 28, 2020 by synaesthesia

[dezza]

A good question, surely it's just line 3 in hapconfig.xml?

 

"secureldap="True" ?

 

Edit - just tested, this works as expected.

 

Thanks, I will look into this! Did you have to setup any certificates or anything on your servers for this to work? Or simply just changed it to 'True'?

[timbo343]

I changed this too in the early hours this morning. Didn't do anything with certs, just changed false to true, saved and tested.

 

I could still log in with some test staff accounts.

[dezza]

I just changed it myself and everything still appears to be working fine! Now to see if it reduces the number of unsecure LDAP connections I'm seeing on my DC's.

 

Thanks everyone!

[MYK-IT]

A good question, surely it's just line 3 in hapconfig.xml?

 

"secureldap="True" ?

 

Edit - just tested, this works as expected.

 

I've changed the same here, and can confirm that it (still) works.

 

Of course, it our intention to stop using HAP+ (purely due to potential security reasons, being unsupported etc.) so anything like this (advice) is greatly appreciated in the interim.

 

When I (re)built our HAP+ server, I also used https://www.nartac.com/Products/IISCrypto/Download and locked down to TLS1.2 only, combined with checking scanning results using https://www.ssllabs.com/ssltest/index.html

[sonofsanta]

Nnnnnnnecro!

 

I've changed the line in inetpub/wwwroot/HAP/App_Data/hapconfig.xml and it works fine for a while, but then I start seeing insecure LDAP binds on my DC logs again even though the XML file is still correct. It seems to revert to insecure binds every time the server restarts. What am I doing wrong?