Re: [pve-devel] [PATCH proxmox-ve-rs 1/1] partial fix #6226: macros: add LDAP_UDP macro

From: "Christoph Heiss" <c.heiss@proxmox.com>
To: "Stefan Hanreich" <s.hanreich@proxmox.com>
Cc: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: Re: [pve-devel] [PATCH proxmox-ve-rs 1/1] partial fix #6226: macros: add LDAP_UDP macro
Date: Wed, 19 Mar 2025 09:50:42 +0100	[thread overview]
Message-ID: <D8K44D12DN35.N2ED1JKP8ROD@proxmox.com> (raw)
In-Reply-To: <20250318153854.303676-1-s.hanreich@proxmox.com>

On Tue Mar 18, 2025 at 4:38 PM CET, Stefan Hanreich wrote:
> Add LDAP_UDP macro to the firewall to support LDAP implementations
> that use UDP as well, such as Windows AD [1]
>
> [1] https://learn.microsoft.com/de-de/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts
> [..]
> --- a/proxmox-ve-config/resources/macros.json
> +++ b/proxmox-ve-config/resources/macros.json
> @@ -377,6 +377,15 @@
>      ],
>      "desc": "Lightweight Directory Access Protocol traffic"
>    },
> +  "LDAP_UDP": {

What about naming it "AD" instead and including both the TCP and UDP
rule instead? I.e. making it completely separate from the "normal" LDAP
rule.

Naming it "LDAP_UDP" could be confusing to users, in that it might be
required for actual, compliant LDAP servers as well, not just AD.

> +    "code": [
> +      {
> +        "dport": "389",
> +        "proto": "udp"
> +      }
> +    ],
> +    "desc": "Lightweight Directory Access Protocol traffic via UDP"
> +  },
>    "LDAPS": {
>      "code": [
>        {

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel