Subject: Re: [TLS] Security concerns around co-locating TLS and non-secure, on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

From: =JeffH <[email-masked]>
Date: Thu, 18 Nov 2010 10:00:13 -0800

Nico stated..
 >
 > I assure you that people use LDAP with StartTLS.

this indeed seems to be the case..

Subject: Re: [ldap] statistics wrt StartTLS vs. dedicated TLS port  usage?
From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 18 Nov 2010 11:32:55 +0100
To: =JeffH <[email-masked]>
Cc: LDAP Discussion List <[email-masked]>

=JeffH writes:
  > I'm curious as to whether anyone has any statistics with resprect to
  > deployed in-the-wild use of StartTLS (e.g. on port 389) vs. use of a
  > dedicated TLS port (e.g. port 636) ?

20 minutes of our main servers' loglevel 256:
     22221 StartTLS from 423 different IP addresses
      1170 ldaps:// from  46 different IP addresses

5 days' log at another server we run has 125278 ldaps:// from 21 IP
addresses, but no StartTLS.

-- 
Hallvard

--

Subject: Re: [ldap] statistics wrt StartTLS vs. dedicated TLS port  usage?
From: Steve Thompson <[email-masked]>
Date: Thu, 18 Nov 2010 05:45:33 -0500 (EST) (02:45 PST)
To: =JeffH <[email-masked]>
Cc: LDAP Discussion List <[email-masked]>

On Wed, 17 Nov 2010, =JeffH wrote:

  > I'm curious as to whether anyone has any statistics with resprect to deployed
  > in-the-wild use of StartTLS (e.g. on port 389) vs. use of a dedicated TLS
  > port (e.g. port 636) ?

My LDAP load balancer shows:

   	StartTLS on 389:	997696 connections
   	ldaps on 636:		 32620 connections

This is a total over about three weeks or so.

-Steve