Common attacks and weaknesses
- Anonymous binds leaking users, groups and the domain structure.
- Clear-text simple binds exposing passwords.
- LDAP relay attacks without signing and channel binding; UDP 389 (CLDAP) used for DDoS amplification.
Port 389: LDAP
Directory access, used by Active Directory and OpenLDAP.
389
How LDAP works
Directory & authenticationThe client proves who it is on port 389 and gets an answer (or a ticket) it can use with other services. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Directory & authentication
Is port 389 dangerous?
How to secure it
- Require LDAP signing and channel binding, or LDAPS.
- Disable anonymous binds.
- Never expose domain controllers to the Internet.
IANA registry entries for port 389
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ldap | 389 | TCP, UDP | Lightweight Directory Access Protocol | - | - |
// source: IANA service name and port number registry
Which program uses port 389, and is it reachable?
Linux
sudo ss -ltnup 'sport = :389' # process listening on 389
sudo lsof -nP -i :389macOS
sudo lsof -nP -i :389
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 389 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 389 netstat -ano | findstr :389
From another machine
nmap -p 389 -sV <host> sudo nmap -sU -p 389 <host> nc -zv <host> 389
Block it in the firewall
sudo ufw deny 389/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 389" -Direction Inbound -LocalPort 389 -Protocol TCP -Action Block # Windows
What is port 389 used for?
Directory access, used by Active Directory and OpenLDAP.
Is port 389 TCP or UDP?
Port 389 is registered for TCP and UDP.
Is it safe to open port 389?
It is rated 6/10 (high) when exposed to the Internet. Anonymous binds leaking users, groups and the domain structure. Require LDAP signing and channel binding, or LDAPS.
How do I check if port 389 is open?
On Linux run "ss -ltnup 'sport = :389'", on macOS "lsof -nP -i :389", and on Windows "netstat -ano | findstr :389" to see the local process. From another machine, "nmap -p 389 <host>" shows whether it is reachable.
Other directory & authentication ports
:636 LDAPS tcp · udp · moderate risk :88 Kerberos tcp · udp · high risk :3268 Global Catalog (LDAP) tcp · udp · high risk :1812 RADIUS udp · tcp · moderate risk :31 MSG Authentication tcp · udp :49 Login Host Protocol (TACACS) tcp · udp :56 XNS Authentication tcp · udp :113 Authentication Service tcp · udp