Re: [TLS] Security concerns around co-locating TLS and non-secure, on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

=JeffH <Jeff.Hodges@KingsMountain.com> Thu, 18 November 2010 17:59 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=bSTGcPglQwH9bcPrRszZESkCM74dVZpsshp4tVHzOnA84J3yZwViG5vrfrxfBXwcd3I6RJtX+P/zn/7v00xwX19VuHK8yfOBRBLuxi7Slq24mam5vgZ5uik5LVzMpsef;
Message-ID: <4CE569AD.6090402@KingsMountain.com>
Date: Thu, 18 Nov 2010 10:00:13 -0800
From: =JeffH <Jeff.Hodges@KingsMountain.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20101027)
MIME-Version: 1.0
To: tsvwg@ietf.org, tls@ietf.org
Subject: Re: [TLS] Security concerns around co-locating TLS and non-secure, on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Precedence: list

Nico stated..
 >
 > I assure you that people use LDAP with StartTLS.

this indeed seems to be the case..

Subject: Re: [ldap] statistics wrt StartTLS vs. dedicated TLS port  usage?
From: Hallvard B Furuseth <h.b.furuseth@usit.uio.no>
Date: Thu, 18 Nov 2010 11:32:55 +0100
To: =JeffH <Jeff.Hodges@KingsMountain.com>
Cc: LDAP Discussion List <ldap@umich.edu>

=JeffH writes:
  > I'm curious as to whether anyone has any statistics with resprect to
  > deployed in-the-wild use of StartTLS (e.g. on port 389) vs. use of a
  > dedicated TLS port (e.g. port 636) ?

20 minutes of our main servers' loglevel 256:
     22221 StartTLS from 423 different IP addresses
      1170 ldaps:// from  46 different IP addresses

5 days' log at another server we run has 125278 ldaps:// from 21 IP
addresses, but no StartTLS.

-- 
Hallvard

--

Subject: Re: [ldap] statistics wrt StartTLS vs. dedicated TLS port  usage?
From: Steve Thompson <smt@vgersoft.com>
Date: Thu, 18 Nov 2010 05:45:33 -0500 (EST) (02:45 PST)
To: =JeffH <Jeff.Hodges@KingsMountain.com>
Cc: LDAP Discussion List <ldap@umich.edu>

On Wed, 17 Nov 2010, =JeffH wrote:

  > I'm curious as to whether anyone has any statistics with resprect to deployed
  > in-the-wild use of StartTLS (e.g. on port 389) vs. use of a dedicated TLS
  > port (e.g. port 636) ?

My LDAP load balancer shows:

   	StartTLS on 389:	997696 connections
   	ldaps on 636:		 32620 connections

This is a total over about three weeks or so.

-Steve

Re: [TLS] Security concerns around co-locating TL… =JeffH