Port 389 (LDAP)
Directory queries, most often against Active Directory domain controllers.
- Transport
- TCP/UDP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Unsigned, unencrypted LDAP binds expose credentials and allow relay attacks.
- Connectionless LDAP (CLDAP, UDP 389) has been abused for amplification DDoS.
- Attackers query LDAP heavily to map users, groups and admins (e.g. BloodHound collection).
When it shows up in your logs
A single host making very large numbers of LDAP queries can be directory reconnaissance.