Secure Directory Services
Summary
PDF p.280A network directory lists users, computers, services, and objects on a network, along with their permissions. It facilitates authentication and authorization and must be highly secure. Most directory services use the Lightweight Directory Access Protocol (LDAP), which requires secure configurations to prevent vulnerabilities.
In plain words
Supplementary — not from your PDFDirectories (usually accessed with LDAP) hold users, computers and permissions, so they must be protected. Plain LDAP on port 389 is unencrypted. Anonymous access and simple bind (DN and password in plaintext) are unsafe. Use SASL (for example Kerberos, with STARTTLS) or LDAPS on port 636, which uses a certificate. Separate read-only and read/write access, and never expose LDAP to the Internet.
Detailed explanation
PDF p.280-
LDAP Basics
- Port: Runs over port 389.
- Security: Basic LDAP provides no security; transmissions are in plaintext.
-
Authentication Methods
- No Authentication: Grants anonymous access.
- Simple Bind: Client supplies distinguished name (DN) and password in plaintext.
- Simple Authentication and Security Layer (SASL): Negotiates supported authentication mechanisms (e.g., Kerberos) and can use STARTTLS for encryption and message integrity.
- LDAP Secure (LDAPS): Uses a digital certificate to set up a secure tunnel for user credential exchange, running over port 636.
Security Recommendations
- Disable Insecure Methods: Disable anonymous and simple authentication if secure access is required.
- Access Levels: Implement read-only (query) and read/write (update) access using an access control policy.
- Network Access: Restrict LDAP server access to the private network and block LDAP port from public access. Allow only authorized IPs for Internet integration.
Important terms
taken from the text above- Port
- Runs over port 389.
- No Authentication
- Grants anonymous access.
- Simple Bind
- Client supplies distinguished name (DN) and password in plaintext.
- Simple Authentication and Security Layer (SASL)
- Negotiates supported authentication mechanisms (e.g., Kerberos) and can use STARTTLS for encryption and message integrity.
- LDAP Secure (LDAPS)
- Uses a digital certificate to set up a secure tunnel for user credential exchange, running over port 636.
- Disable Insecure Methods
- Disable anonymous and simple authentication if secure access is required.
- Access Levels
- Implement read-only (query) and read/write (update) access using an access control policy.
- Network Access
- Restrict LDAP server access to the private network and block LDAP port from public access. Allow only authorized IPs for Internet integration.
Examples & real-world scenarios
Supplementary — not from your PDF- Moving applications from LDAP 389 to LDAPS 636.
- Disabling anonymous bind on a directory server.
- Firewalling the directory so only internal subnets can reach it.
Scenario
An app authenticates users with LDAP simple bind over port 389, so passwords cross the network in clear text. Reconfiguring it to use LDAPS protects the credentials in transit.
Common mistakes
Supplementary — not from your PDF- Using simple bind without TLS.
- Mixing up the ports: 389 is LDAP, 636 is LDAPS.
Practical skills
Supplementary — not from your PDF- Recommend secure LDAP settings.
What I should remember
Key Points PDF p.280-
LDAP Basics
- Port 389: Default port for LDAP.
- No Security: Plaintext transmissions.
-
Authentication Methods
- No Authentication: Anonymous access.
- Simple Bind: Plaintext DN and password.
- SASL: Uses mechanisms like Kerberos with STARTTLS.
- LDAPS: Secure tunnel with digital certificate, port 636.
-
Security Recommendations
- Disable Insecure Methods: Anonymous and simple authentication.
- Access Levels: Read-only and read/write access.
- Network Access: Restrict to private network, block public access, allow authorized IPs.