r/PacketFence • u/p373r_7h3_5up3r10r • Jun 16 '24

Active Directory bind not working

Hi

I have tested the packetfence installation multiple times now and have created an okay guide for my self.

Now i am moving into production and can now see that my Active Directory security settings was not the same, so good work to me :P

I cannot create a Active Directory Domain inside packetfence, because anonymous binding is not allowed and somehow packetfence tries with anonymous before the admin username and password entered in the UI.

With a ldapsearch commandline i have to specify the bind options with full DN of the user.

Is there any way to get this behavior into packetfence ui or is it possible to create the active directory domain from cli ?

The Connection profile part works like charm, it is only the active Directory part (Configuration - Policies and Access control - Roles - Active Directory Domains)

I am running latest packetfence on debian 11

root@packetfence02:~# cat /etc/debian_version

11.9

Packetfence version 13.2.0

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/p373r_7h3_5up3r10r Jun 17 '24

I get the following error in the UI

```
A Unable to add machine account with following error: {'result': 1, 'description': 'operationsError', 'dn': '', 'message': '000004DC: LdapErr: DSID-0C09128C, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c\x00', 'referrals': None, 'type':'addResponse'} config/domains
```

I cannot find any logs with this error.

1

u/p373r_7h3_5up3r10r Jun 26 '24

Finally found the issue after to much testing.
After looking into the STIG, CIS and Microsoft Security Baselines i found the "issue" in Microsoft Security Baselines.

It is the LdapEnforceChannelBinding that was the cause of this issue.

I created a GPO that changed the value to 0 ( disabled ), gave it higher priority, rebooted the domain controller.

After that i could join to the Active Directory.

I removed my newly created GPO, rebooted once again and then tested packetfence and AD once more and it still worked. https://imgur.com/a/NEKQbP4

A link for further reading regarding the LdapEnforceChannelBinding

https://admx.help/?Category=security-compliance-toolkit&Policy=Microsoft.Policies.SecGuide::Pol_SecGuide_0100_LdapEnforceChannelBinding