topic Re: Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636 in Firewall and Security Management

Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636

checkpointer — Tue, 15 Nov 2022 13:17:13 GMT

Hello Gents,

Just seeking an opinion on how risky it would be to stick with port 389 over 636 for communication with domain controller.

Cheers,

CPter

Re: Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636

Chris_Atkinson — Wed, 16 Nov 2022 01:53:22 GMT

Suggest researching the relevant Microsoft recommendations and what they're enforcing, for example:

https://support.microsoft.com/en-us/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a

Re: Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636

Lesley — Wed, 16 Nov 2022 09:32:57 GMT

Hello,

Make a packet capture while running on encrypted on port 389. You will see everything. This makes it vulnerable for men in the middle attacks. Attackers could steal or change data in the AD. I would strongly recommend to use 636 with fingerprint Check Point. The only downside for 636 in combination with Check Point is the random fingerprint changes. Please refer to this SK to get better understanding:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk42905

https://community.checkpoint.com/t5/Security-Gateways/Check-Point-LDAPS-connection-breaks-everytime-AD-certificate-is/td-p/100671