ksalomon

We deployed Devolutions PAM via Devolutions Gateway at our customer sites. We recently noticed that the DGW isn't providing a tls-server-end-point channel binding token when connecting to the AD Domain using LDAPS (Port 636). When the customer starts enforcing LDAPS Channel Binding in their AD DV PAM will stop working. Is this something you guys could implement? We noticed this when trying to connect a PAM Provider via a Gateway using LDAPS

Thanks for the swift response. Tested: working. Maybe convert to feature request to at least ask if the otp source should be set when linked credential contains otp seed?

When linking a credential entry which holds otp seed to e.g. a website entry this entry does not display "copy otp" option in context menu

Hi again,

thanks for this well thought response. I will provide feedback as soon as possible

Hello Benoit,

thanks for your swift response.

1. Are your Gateways using certificates from a public CA or from a private/internal CA that you operate?

   1. They will be using certs from an internal ca

2. How frequently do you need to rotate those certificates?

   1. As these will be webserver certificates, and in prep to standard practices they will be rotatet every 47 days (https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days)

3. Which scenario worries you most (e.g., insider issuing a rogue cert, DNS/host‑file tampering inside a client network, external CA compromise)?

   1. In principle all of these, in particular DNS poisoning and host file tampering

4. Would pinning a public‑key hash (allows routine certificate renewals) satisfy the requirement, or do you need to pin to a specific leaf certificate?

   1. I forwarded this question to our security team and will submit the answer later

Thanks in advance

Hello,

William advised me to open a request here regarding Certificate Pinning. It would be nice if the connection between DVLS and DGW would be using Certificate Pinning. As our gateways will be residing inside our customers infrastructure (were a MSP) there is the risk of a MITM DGW answering to our DVLS. As this Gateway would be "spoofed" it may exploit our DVLS resulting in a big security hit