topic Re: How do I identify insecure LDAP connections? in Security https://community.splunk.com/t5/Security/How-do-I-identify-insecure-LDAP-connections/m-p/61633#M2057 <P>I found a possible solution using the ssf value (security strength factor). When StartTLS or SSL is used, the ssf is greater than 0. But the ssf value is logged as 0 at other points when the connection <EM>is</EM> secure. By finding connections where ssf &lt; 128, you can filter out the secure connections.</P> <P><CODE>source="YOUR-LDAP-SOURCE" | transaction conn maxpause=5m | search ssf&lt;128 | top uid</CODE></P> <P>By using the transaction command you can group the individual connection sequences by the <CODE>conn</CODE> attribute, then search for those with a lower ssf AES bit encryption.</P> Wed, 12 Jun 2013 17:25:53 GMT saltybeagle 2013-06-12T17:25:53Z How do I identify insecure LDAP connections? https://community.splunk.com/t5/Security/How-do-I-identify-insecure-LDAP-connections/m-p/61632#M2056 <P>I'm trying to identify insecure connections to our LDAP server. We're using OpenLDAP, and I want to exclude connections which use STARTTLS or port 636.</P> Wed, 12 Jun 2013 17:19:57 GMT https://community.splunk.com/t5/Security/How-do-I-identify-insecure-LDAP-connections/m-p/61632#M2056 saltybeagle 2013-06-12T17:19:57Z Re: How do I identify insecure LDAP connections? https://community.splunk.com/t5/Security/How-do-I-identify-insecure-LDAP-connections/m-p/61633#M2057 <P>I found a possible solution using the ssf value (security strength factor). When StartTLS or SSL is used, the ssf is greater than 0. But the ssf value is logged as 0 at other points when the connection <EM>is</EM> secure. By finding connections where ssf &lt; 128, you can filter out the secure connections.</P> <P><CODE>source="YOUR-LDAP-SOURCE" | transaction conn maxpause=5m | search ssf&lt;128 | top uid</CODE></P> <P>By using the transaction command you can group the individual connection sequences by the <CODE>conn</CODE> attribute, then search for those with a lower ssf AES bit encryption.</P> Wed, 12 Jun 2013 17:25:53 GMT https://community.splunk.com/t5/Security/How-do-I-identify-insecure-LDAP-connections/m-p/61633#M2057 saltybeagle 2013-06-12T17:25:53Z