<html><head><base href="x-msg://378/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">For CUPS (the server) it pulls the ldap synchronization from the CUCM configuration. If you want this to be secure then configure LDAPS in CUCM.<div><br></div><div>On the CUPC clients the ldap searches they make can be configured to use TLS or anonymous bind (neither will have cleartext passwords on the wire). You configure TLS per-server in CUPS Application->CUPC->Ldap Server. The anonymous bind is configured in the Ldap Profile.</div><div><br></div><div>To use LDAPS from CUPS to AD you'll need to upload the certificate information to the CUPS OS page the same as CUCM.</div><div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div>-Ryan</div></span>
</div>
<br><div><div>On Nov 24, 2009, at 3:02 AM, wael ahmed el mezain wrote:</div><br class="Apple-interchange-newline"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="hmmessage" style="font-size: 10pt; font-family: Verdana; ">Guys, thanks for reply<span class="Apple-converted-space"> </span><br> <br>But anyone has solution for this ?<br>I used to get the solutions for my issues from this group.<br> <br>Thanks,<br>Wael<br><hr id="stopSpelling">Subject: RE: [cisco-voip] security concern regarding cups<br>Date: Mon, 23 Nov 2009 13:11:00 -0500<br>From:<span class="Apple-converted-space"> </span><a href="mailto:jason.aarons@us.didata.com">jason.aarons@us.didata.com</a><br>To:<span class="Apple-converted-space"> </span><a href="mailto:voicenoob@gmail.com">voicenoob@gmail.com</a>;<span class="Apple-converted-space"> </span><a href="mailto:wael733@hotmail.com">wael733@hotmail.com</a>;<span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><br><div class="ecxSection1"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Phone Messenger has same issue, I understand there is/will be fix for the IP Phone Service to be https. Can’t recall where I just read about it -jason</span></div><p class="ecxMsoNormal" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "> </span></p><div><div style="border-right-width: medium; border-right-style: none; border-right-color: initial; padding-right: 0in; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; border-top-style: solid; padding-left: 0in; padding-bottom: 0in; border-left-width: medium; border-left-style: none; border-left-color: initial; padding-top: 3pt; border-bottom-width: medium; border-bottom-style: none; border-bottom-color: initial; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><span class="Apple-converted-space"> </span>[mailto:cisco-voip-bounces@puck.nether.net]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>VoiceNoob<br><b>Sent:</b><span class="Apple-converted-space"> </span>Monday, November 23, 2009 8:40 AM<br><b>To:</b><span class="Apple-converted-space"> </span>'wael ahmed el mezain';<span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [cisco-voip] security concern regarding cups</span></div></div></div><p class="ecxMsoNormal" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "> </p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Are you SURE it is sending the LDAP password in plaintext? Have you done a packet capture? Also the screen shot you sent is the AXL configuration not CUPS querying LDAP.</span></div><p class="ecxMsoNormal" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "> </span></p><div><div style="border-right-width: medium; border-right-style: none; border-right-color: initial; padding-right: 0in; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; border-top-style: solid; padding-left: 0in; padding-bottom: 0in; border-left-width: medium; border-left-style: none; border-left-color: initial; padding-top: 3pt; border-bottom-width: medium; border-bottom-style: none; border-bottom-color: initial; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><span class="Apple-converted-space"> </span>[mailto:cisco-voip-bounces@puck.nether.net]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>wael ahmed el mezain<br><b>Sent:</b><span class="Apple-converted-space"> </span>Sunday, November 22, 2009 11:29 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[cisco-voip] security concern regarding cups</span></div></div></div><p class="ecxMsoNormal" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "> </p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; ">Dears,</span></div><p class="ecxMsoNormal" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; "> </span></p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; ">We have a security concern regarding cups.</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; "><br>When CUPS querying LDAP the integration account is sending the user name and password in plain text.</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; "><br>Can we use secure LDAP instead? And Also what is the advantage of the attached screen</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; "><br>Please advice.</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; "><br>Regards,</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: 'Book Antiqua', serif; ">wael ahmed</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 12pt; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: Verdana, sans-serif; "> </span><br class="webkit-block-placeholder"></div><div class="ecxMsoNormal" align="center" style="text-align: center; "><span style="font-size: 10pt; font-family: Verdana, sans-serif; "><hr align="center" width="100%" size="2"></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><span style="font-size: 10pt; font-family: Verdana, sans-serif; ">Windows Live: Make it easier for your friends to see<span class="Apple-converted-space"> </span><a href="http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009">what you’re up to on Facebook.</a></span></div></div><hr size="1"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; "><br><strong>Disclaimer: This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.<span class="Apple-converted-space"> </span></strong><br><br></div><hr>Windows Live: Keep your friends up to date<span class="Apple-converted-space"> </span><a href="http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_1:092010" target="_new">with what you do online.</a><span class="Apple-converted-space"> </span>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br></div></span></div><br></div></body></html>