Cyber security

LDAP Firewall – Enhancing Security With Advanced Active Directory Protection

LDAP Firewall is an open-source tool for Windows servers that lets you audit and restrict incoming LDAP requests.

Its primary use-cases are to protect Domain Controllers, block LDAP-based attacks and tightly control access to the Active Directory schema (e.g enforcing read-only access for users).

The tool is written in C++ and makes use of the Microsoft Detours and JsonCpp packages.

Some useful resources to get you started:

  • Introduction blog post – basics of LDAP and overview of the tool
  • Technical Deep Dive blog post – reverse-engineering the Windows LDAP service and how LDAP Firewall works
  • Leash the Hounds – how to stop BloodHound and other LDAP-based recon attacks using the LDAP Firewall
  • Tutorial video – covers how to install and use the tool
  • LDAP Firewall Workshop video – from DEATHCon 2023

Main Features

  • Allow / block incoming LDAP queries based on different parameters (operation type, source IP, user, DN etc.)
  • Event logging for LDAP queries

How It Works

The LDAP Firewall inspects incoming LDAP operations (which are used to read or modify entries in the AD schema) and allows or blocks the request based on the configured rules.

The operation also gets written into the Windows Event Log with the LDAPFW action and other relevant fields (Distinguished Name, attributes, OID etc.).

Who Is This Made For?

  • Security Engineers who want to control LDAP access and achieve a Least Privilege model
  • Threat Hunters and SOC analysts who want to be create detections and perform investigations around LDAP
  • Security Researchers who want to explore and deepen their understanding of the protocol

Preventing Attacks With LDAPFW

This section describes some common LDAP-based attacks that can be mitigated with the LDAP Firewall.
Sample config.json files can be found in the example_configs folder of this repository.

sAMAccountName Spoofing

LDAPFW can be configured to block all Add operations in order to completely prevent Name Impersonation (CVE-2021-42278) and thus defend against sAMAccountName spoofing.

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

The Growing Role of Digital Libraries in Remote Education

Learning Without Walls Remote education has long been a lifeline for students in rural areas…

6 hours ago

How Do I Do Reverse Image Search

Have you ever come across a picture on the internet and wondered where it came…

21 hours ago

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

2 weeks ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

2 weeks ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

2 weeks ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

2 weeks ago