[Samba] Are the connections between Domain Controlers encrypted?

[Daniel Carrasco Marín]

2015-07-10 22:35 GMT+02:00 Andrew Bartlett <abartlet at samba.org>:

> On Wed, 2015-07-01 at 14:54 +0200, Daniel Carrasco Marín wrote:
> > Hi,
> >
> > Just that is my question: Are the connection between DC encripted?.
> >
> > I'm planning to create a secondary DC on a external dedicated server and
> i
> > want to know if the connections are secure, because is not a good idea to
> > have authentication data traveling through internet without any kind of
> > encription...
> >
> > My main DC have ldap through ssl activated and working fine, but i don't
> > know if that cares or i've to change anything to allow to secondary DC to
> > use secure connections too.
> >
> > Another question: I've to consider anything, for example connection
> speed?
> > (besides the sysvol syncronization of course).
>
> They should be done over a VPN, as while parts are encrypted, Samba
> isn't recommended to be exposed to the public internet (just too many
> protocols, too large an attack surface).
>
> Thanks,
>
> Andrew Bartlett
>
> --
> Andrew Bartlett                       http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT
> http://catalyst.net.nz/services/samba
>
>
>
Thanks for your reply.

I'm planing to create the samba4 secondary DC on an external dedicated
server but on a virtual machine hidden from external traffic.
I want this because i've some services on that server authenticated with
the DC, and if internet connection is lost then that services will stop
working.

I'll see how to create the new VPN network.

Greetings!!