From owner-freebsd-ports@freebsd.org Thu Jan 5 11:04:42 2017 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A7ECFC9EAAA for ; Thu, 5 Jan 2017 11:04:42 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [IPv6:2001:8b0:151:1:c4ea:bd49:619b:6cb3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "smtp.infracaninophile.co.uk", Issuer "infracaninophile.co.uk" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 6B5491CBF for ; Thu, 5 Jan 2017 11:04:42 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from ox-dell39.ox.adestra.com (unknown [85.199.232.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: m.seaman@infracaninophile.co.uk) by smtp.infracaninophile.co.uk (Postfix) with ESMTPSA id 04C919379 for ; Thu, 5 Jan 2017 11:04:37 +0000 (UTC) Authentication-Results: smtp.infracaninophile.co.uk; dmarc=none header.from=FreeBSD.org Authentication-Results: smtp.infracaninophile.co.uk/04C919379; dkim=none; dkim-atps=neutral Subject: Re: openldap-client vs openldap-sasl-client To: freebsd-ports@freebsd.org References: <34b66662-a2d7-706d-3653-e0ffc9bf81b2@rlwinm.de> <20170105104326.GB2648@home.opsec.eu> From: Matthew Seaman Message-ID: Date: Thu, 5 Jan 2017 11:04:23 +0000 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170105104326.GB2648@home.opsec.eu> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,RCVD_IN_RP_RNBL, RDNS_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on smtp.infracaninophile.co.uk X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jan 2017 11:04:42 -0000 On 01/05/17 10:43, Kurt Jaeger wrote: > Hi! > > [openldap-client vs openldap-sasl-client and libreoffice etc] >> Yes and yes it sucks. The "solution" is to build your own repo and set >> the right flags to always use the same LDAP client port. With binary >> packages and the speed of modern x86_64 systems I for one no longer see >> removing SASL support from OpenLDAP as useful enough to justify the >> complexity. > > The other question is: What's the use of SASL anyway ? I've seen it > for years in mailserver setups, etc, and it always caused trouble. > SASL effectively gets you a number of new authentication mechanisms. Most of these are ways of proving you know a secret without sending the actual secret (ie. password) over the net in plain text, but I think it also adds the ability to use client TLS certificates for authentication. IIRC. I don't see much value in the extra mechanisms for secure login over unencrypted links nowadays. Pretty much everything I'm using currently already requires TLS for good security reasons, so there's no real downside to using plain LOGIN over the encrypted channel. Plus the 'proof of knowledge' authentication mechanisms have a big downside: they need the secret stored in the LDAP database in plain text, or in some locally reversible encryption. With LOGIN over TLS, I can use salted password hashes in much the same way as Unix passwords. SASL would be worth it for TLS client certificate functionality, if that's the only way to enable that. Cheers, Matthew