Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity.

  • AD Query to pull out machine authentication from logs.
  • Identity Agent (software) to log on to the Domain Controller via the firewall.

After some work with Identity Agent, which does not work to well with multiple domain controllers, I'm looking at the possibility to let clients log onto the AD to establish the identity.

Considering that the idea of this solution is to block unknown computers at the firewall, I am a bit reluctant to allow them access to the Domain Controller. Especially since the DC can be considered the "Crown Jewel" security-wise.

Now for the question,

What traffic should be allowed from clients to the Domain Controllers to allow them to login?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Well I guess first off, what port are they going through your firewall and getting to the domain controller? You just need to make sure they can get through port 389 for LDAP if they are authenticating against AD. I'm not sure what else you are asking in regards to what traffic should be allowed from the clients, that's up to you to set the rules for your environment.

Personally, I'd set up a security group in your firewall/vpn appliance (assuming you have a vpn appliance or function on your firewall). Generate some certs from your internal CA and create a web login (some vpn appliances will have one built in already). Only distribute those certs to the people you want to access your network from outside of your organization. This is now limiting access to only that PC you originally wanted to do, since the cert can only be installed to one PC.

share|improve this answer
    
Yes, but I'm not sure what the minimum requirements of open ports that are required for a client to authenticate against a domain server. –  Dog eat cat world Dec 21 '11 at 21:19
1  
Should be 389 if it's not secure, 636 if it's using TLS/SSL. Also other possibilities are 7648-7652, 24032. These are also used for CU-SeeMe & Enhanced CUSM application –  Split71 Dec 23 '11 at 16:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.