LDAP Signing

๐Ÿ”’ย Secure Bits ๐Ÿ’ก
๐—›๐—ผ๐˜„ ๐˜๐—ผ ๐˜๐—ฟ๐—ฎ๐—ฐ๐—ธ ๐—Ÿ๐——๐—”๐—ฃ ๐˜€๐—ถ๐—ด๐—ป๐—ถ๐—ป๐—ด ๐—ถ๐—ป ๐—”๐—ฐ๐˜๐—ถ๐˜ƒ๐—ฒ ๐——๐—ถ๐—ฟ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ๐˜† ๐—ฏ๐—ฒ๐—ณ๐—ผ๐—ฟ๐—ฒ ๐—ฒ๐—ป๐—ณ๐—ผ๐—ฟ๐—ฐ๐—ถ๐—ป๐—ด ๐—ถ๐˜?

When applying ๐˜€๐˜๐—ฟ๐—ถ๐—ฐ๐˜ ๐—ฆ๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—•๐—ฎ๐˜€๐—ฒ๐—น๐—ถ๐—ป๐—ฒ๐˜€, enforcingย LDAP signingย is a common (and critical) step. It disables weak authentication methods likeย LDAP simple bind, which transmits credentials in plaintext and no signing allows MITM attacks.

But if your infrastructure is older, ๐—ฒ๐—ป๐—ณ๐—ผ๐—ฟ๐—ฐ๐—ถ๐—ป๐—ด ๐—ถ๐˜ ๐—ผ๐˜‚๐˜๐—ฟ๐—ถ๐—ด๐—ต๐˜ ๐—ฐ๐—ฎ๐—ป ๐—ฏ๐—ฟ๐—ฒ๐—ฎ๐—ธ ๐˜๐—ต๐—ถ๐—ป๐—ด๐˜€.

๐Ÿ’ฅ So before enforcement โ€”ย ๐˜๐—ฟ๐—ฎ๐—ฐ๐—ธ ๐˜„๐—ต๐—ฎ๐˜โ€™๐˜€ ๐˜‚๐˜€๐—ถ๐—ป๐—ด ๐˜‚๐—ป๐˜€๐—ถ๐—ด๐—ป๐—ฒ๐—ฑ ๐—Ÿ๐——๐—”๐—ฃ.

๐—›๐—ฒ๐—ฟ๐—ฒโ€™๐˜€ ๐—ต๐—ผ๐˜„:
๐Ÿ“ย ๐—ฆ๐˜๐—ฒ๐—ฝ ๐Ÿญ โ€” ๐—–๐—ต๐—ฒ๐—ฐ๐—ธ ๐—ฑ๐—ฒ๐—ณ๐—ฎ๐˜‚๐—น๐˜ ๐—น๐—ผ๐—ด๐˜€
Event IDย 2887ย in theย Directory Serviceย log reports unsigned LDAP attempts every 24 hours. But itโ€™s vague.

๐Ÿ”ย ๐—ฆ๐˜๐—ฒ๐—ฝ ๐Ÿฎ โ€” ๐—˜๐—ป๐—ฎ๐—ฏ๐—น๐—ฒ ๐—ฑ๐—ฒ๐˜๐—ฎ๐—ถ๐—น๐—ฒ๐—ฑ ๐—ฑ๐—ถ๐—ฎ๐—ด๐—ป๐—ผ๐˜€๐˜๐—ถ๐—ฐ๐˜€
Registry path:
HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics
Setย 16 LDAP Interface Eventsย toย 2

This gives youย ๐—˜๐˜ƒ๐—ฒ๐—ป๐˜ ๐—œ๐—— ๐Ÿฎ๐Ÿด๐Ÿด๐Ÿต, which showsย exact clientsย using unsigned LDAP.

โœ… Use this toย find and fix legacy appsย before enforcing LDAP Signing and disabling Simple Bind.

๐Ÿ’กย ๐—”๐˜ƒ๐—ผ๐—ถ๐—ฑ ๐˜๐—ต๐—ฒ โ€œ๐—ฒ๐—ป๐—ณ๐—ผ๐—ฟ๐—ฐ๐—ฒ โ†’ ๐—ฏ๐—ฟ๐—ฒ๐—ฎ๐—ธ ๐—ฒ๐˜ƒ๐—ฒ๐—ฟ๐˜†๐˜๐—ต๐—ถ๐—ป๐—ดโ€ scenario โ€” audit first.

๐Ÿ“Œ In this series, Iโ€™ll be coveringย ๐—ฟ๐—ฒ๐—ฎ๐—น-๐˜„๐—ผ๐—ฟ๐—น๐—ฑ ๐—ฐ๐—ต๐—ฎ๐—น๐—น๐—ฒ๐—ป๐—ด๐—ฒ๐˜€ ๐—ผ๐—ณ ๐—ฎ๐—ฝ๐—ฝ๐—น๐˜†๐—ถ๐—ป๐—ด ๐˜€๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—ฏ๐—ฎ๐˜€๐—ฒ๐—น๐—ถ๐—ป๐—ฒ๐˜€ย โ€” including the exceptions you sometimesย mustย make to keep legacy infrastructure operational. Based on lessons from production environments.