Acronis 12.5 - LDAPS
Hello, I can't find this information anywhere - does Acronis Backup support LDAP over SSL (LDAPS) and if so, is there a way to force Acronis to use it? (use port 636 instead of 389) Thank you Lukas
Hello Maria,
thank you for your answer, I will wait for this feature to be implemented, then.
Lukas
Dear All,
Did you get any update afterwards for this requirement, we are facing the same request from security team.
Jason wrote:Dear All,
Did you get any update afterwards for this requirement, we are facing the same request from security team.
Hello Jason,
I'm afraid an estimated date for the implementation of this feature is not yet unavailable. However, I've registered your comment as a vote for the feature request, thank you! You can find information about new features in the product release notes: https://www.acronis.com/support/updates/index.html
Hello,
I must refresh this topic as I've run into problems which seem to be directly related to this one.
Recently I've set up a test server for Acronis Cyber Backup 15 and just when I finished the installation and started with setup of Administrators groups (organization units) and adding users, I came to the literal show stopper (at least for our use case).
I was unable to add any domain users/groups
So, I went to our v12.5 test server ... and got the same result. And on production server (also running 12.5) as well! All groups/users already there are untouched, but I'm unable to add any other. (and of course, even after I manually specify credentials for domain account with access to AD)
I've contacted our domain team and was told, that our domain controllers accept only secure LDAP and LDAPS and that it looks like Acronis is trying to use LDAP and this needs to be changed on the application side.
LDAP was disabled some time ago and won't be enabled again (for security reasons).
It seems our DC servers are set up in accordance to this Microsoft security recommendation: 2020 LDAP channel binding and LDAP signing requirements for Windows (microsoft.com) (unable to add links, sorry, but it's first link on google if you copy the name)
Specifically:
"The security of Active Directory domain controllers can be significantly improved by configuring the server to reject Simple Authentication and Security Layer (SASL) LDAP binds that do not request signing (integrity verification) or to reject LDAP simple binds that are performed on a clear text (non-SSL/TLS-encrypted) connection. SASLs may include protocols such as the Negotiate, Kerberos, NTLM, and Digest protocols"
On our production Acronis servers the groups and users were set up a few years ago, so it was before LDAP was disabled and we didn't need to adjust it since. That's why I noticed this only now.
So, if that's really the reason why I'm unable to add any domain users, then I don't understand why Acronis still doesn't allow switch to either secure LDAP or LDAPS. This would mean end of our Acronis use in the near future and currently set up v12.5 servers would be the last we are using and would need to switch to another backup/recovery solution.
Is explanation of our domain team really the reason why it doesn't work? (to clarify: domain users are able to login to Acronis console, we are just unable to add any more domain users in SETTINGS -> Administrators)
If so, is it either possible to switch to secure LDAP/LDAPS on the application side or is there at least some workaround how to add domain users to organization units manually?
I'm still not fully convinced, that it's really just because Acronis uses only unsecure LDAP as in that case I would expect that you have many more customers with the same problem and it would be already sorted out at least in v15 (which it is not), but it's the only explanation I've got so far.
Thank you for any feedback
Lukas
Hello,
so, the only workardound I've found, is to create local user group on the application server for each organization unit and assign necessary domain accounts/groups to them.
Hopefully it will work for all use cases..
Lukas