LDAP
LDAP (Lightweight Directory Access Protocol, RFC 4511) is used to query and update directory services -- most commonly Active Directory -- that store user accounts, group memberships, and authentication data for an organization. Plain LDAP on port 389 transmits queries and, critically, the bind credentials used to authenticate, without encryption by default, unless the connection is upgraded with STARTTLS or run over the separate LDAPS port (636) with TLS from the start. A directory service reachable from the open internet over unencrypted LDAP exposes authentication traffic to interception and gives an external attacker a direct path to probe an organization's user and group structure, information normally only reachable from inside the corporate network. Directory services are meant to sit behind a firewall or VPN, not be directly internet-facing, regardless of which LDAP variant is in use.
By AdminKit team, Netbase JSC · Updated