Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
checkpointer
Participant
Jump to solution

Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636

 

Hello Gents,

Just seeking an opinion on how risky it would be to stick with port 389 over 636 for communication with domain controller.

Cheers,

CPter

 

 

0 Kudos
1 Solution

Accepted Solutions
Lesley
Advisor

Hello,

Make a packet capture while running on encrypted on port 389. You will see everything. This makes it vulnerable for men in the middle attacks. Attackers could steal or change data in the AD. I would strongly recommend to use 636 with fingerprint Check Point. The only downside for 636 in combination with Check Point is the random fingerprint changes. Please refer to this SK to get better understanding: 

 

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Security-Gateways/Check-Point-LDAPS-connection-breaks-everytime-...

 

-------
If you like this post please give a thumbs up(kudo)! 🙂

View solution in original post

(1)
2 Replies
Chris_Atkinson
Employee Employee
Employee

Suggest researching the relevant Microsoft recommendations and what they're enforcing, for example:

https://support.microsoft.com/en-us/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-fo...

 

CCSM R77/R80/ELITE
0 Kudos
Lesley
Advisor

Hello,

Make a packet capture while running on encrypted on port 389. You will see everything. This makes it vulnerable for men in the middle attacks. Attackers could steal or change data in the AD. I would strongly recommend to use 636 with fingerprint Check Point. The only downside for 636 in combination with Check Point is the random fingerprint changes. Please refer to this SK to get better understanding: 

 

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Security-Gateways/Check-Point-LDAPS-connection-breaks-everytime-...

 

-------
If you like this post please give a thumbs up(kudo)! 🙂
(1)

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events