Authentication and connection to a domain controller

Authentication and connection to a domain controller when scanning a domain

When scanning a domain controller, Administration Server or a distribution point identifies the connection protocol to establish initial connection to the domain controller. This protocol is used for all future connections to the domain controller.

The initial connection to a domain controller proceeds as follows:

1. Administration Server or a distribution point attempts to connect to the domain controller over LDAPS.

   By default, certificate verification is not required. Set the KLNAG_LDAP_TLS_REQCERT flag to 1 to enforce certificate verification.

   Possible values of the KLNAG_LDAP_TLS_REQCERT_AUTH flag:

   • 0—The certificate is requested, but if it is not provided or the certificate verification failed, then the TLS connection is still considered successfully created (default value).
   • 1—Strict verification of the LDAP server certificate is required.

   By default, the path to the certificate authority (CA) that is used to access the certificate chain is not specified. Use the KLNAG_LDAP_SSL_CACERT flag to specify the path.

2. If the LDAPS connection fails, Administration Server or a distribution point attempts to connect to the domain controller over non-encrypted TCP connection by using SASL (DIGEST-MD5).

Authentication and connection to a domain controller when authenticating a domain user to Administration Server

When a domain user authenticates on Administration Server, Administration Server identifies the protocol to establish connection to the domain controller.

The connection to a domain controller proceeds as follows:

1. Administration Server attempts to connect to the domain controller over LDAPS.

   By default, certificate verification is required. Use the KLNAG_LDAP_TLS_REQCERT_AUTH flag to configure certificate verification.

   Possible values of the KLNAG_LDAP_TLS_REQCERT_AUTH flag:

   • 0—The certificate is requested, but if it is not provided or the certificate verification failed, then the TLS connection is still considered successfully created.
   • 1—Strict verification of the LDAP server certificate is required (default value).

   By default, the path to the certificate authority (CA) that is used to access the certificate chain is not specified. Use the KLNAG_LDAP_SSL_CACERT flag to specify the path.

2. If the LDAPS connection fails, an error connecting to the domain controller occurs and other connection protocols are not used.

Configuring flags

You can use the klscflag utility to configure flags.

Run the command line, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the directory where the Administration Server is installed. The default installation path is /opt/kaspersky/ksc64/sbin.

For example, the following command enforces certificate verification:

klscflag -fset -pv klserver -n KLNAG_LDAP_TLS_REQCERT -t d -v 1