LDAP Authenticator: unencrypted traffic with 'use_start_tls = True'

[theodotos]

I've setup the LDAP authenticator with on our mumble server but checking the traffic with tcpdump I've noticed that only the first query is encrypted. Subsequent queries are unecrypted. No user pass is leaked (used in the first query) but all the user's details and the bind pass are leaked.

You can verify this with:

$ sudo tcpdump host ldap.example.com -s0 -w mumble-ldap.pcap

and read the mumble-ldap.pcap file with wireshark.

[theodotos]

A workaround is to use ldap_uri = ldaps://ldap.example.com and comment out use_start_tls.

[Kissaki]

I guess the configuration file and possible script file header should make this clear - documentation-wise.