CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Directory & authentication

Port 389: LDAP

Directory access, used by Active Directory and OpenLDAP.

Lightweight Directory Access ProtocolActive Directory
389

How LDAP works

Directory & authentication
userdirectorybindOKTLS only if enabled userdirectorybindOKTLS only if enabled

The client proves who it is on port 389 and gets an answer (or a ticket) it can use with other services. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP · UDP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Directory & authentication
01 Security

Is port 389 dangerous?

Common attacks and weaknesses

  • Anonymous binds leaking users, groups and the domain structure.
  • Clear-text simple binds exposing passwords.
  • LDAP relay attacks without signing and channel binding; UDP 389 (CLDAP) used for DDoS amplification.

How to secure it

  • Require LDAP signing and channel binding, or LDAPS.
  • Disable anonymous binds.
  • Never expose domain controllers to the Internet.
02 Registry

IANA registry entries for port 389

ServicePortTransportDescriptionReferenceUpdated
ldap 389 TCP, UDP Lightweight Directory Access Protocol - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 389, and is it reachable?

Linux

sudo ss -ltnup 'sport = :389'      # process listening on 389
sudo lsof -nP -i :389

macOS

sudo lsof -nP -i :389

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 389 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 389
netstat -ano | findstr :389

From another machine

nmap -p 389 -sV <host>
sudo nmap -sU -p 389 <host>
nc -zv <host> 389

Block it in the firewall

sudo ufw deny 389/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 389" -Direction Inbound -LocalPort 389 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 389 used for?

Directory access, used by Active Directory and OpenLDAP.

Is port 389 TCP or UDP?

Port 389 is registered for TCP and UDP.

Is it safe to open port 389?

It is rated 6/10 (high) when exposed to the Internet. Anonymous binds leaking users, groups and the domain structure. Require LDAP signing and channel binding, or LDAPS.

How do I check if port 389 is open?

On Linux run "ss -ltnup 'sport = :389'", on macOS "lsof -nP -i :389", and on Windows "netstat -ano | findstr :389" to see the local process. From another machine, "nmap -p 389 <host>" shows whether it is reachable.

05 Related
:636 LDAPS tcp · udp · moderate risk :88 Kerberos tcp · udp · high risk :3268 Global Catalog (LDAP) tcp · udp · high risk :1812 RADIUS udp · tcp · moderate risk :31 MSG Authentication tcp · udp :49 Login Host Protocol (TACACS) tcp · udp :56 XNS Authentication tcp · udp :113 Authentication Service tcp · udp

Latest vulnerability news

All news