Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs?
Addendum 1:
Our business case, our Cloud based remote hosted web-application needs to authenticate end users with their local Active Directory.
Several cloud vendors require LDAP access to AD in order to authenticate users... I can name 10 off the top of my head; so it's not uncommon in a limited scope.
I would say it is unwise to open up LDAP to the broad internet (no IP filter) without additional controls (VPN, authentication,etc)
Since you're exposing your LDAP server to additional load, I would consider the impact it has on other AD-reliant applications like Exchange, or even workstation authentication. You may want to consider standing up a separate AD server in a separate logical site for this purpose. (Exchange has a tendency to touch all AD servers in a site)
Assuming that the LDAPS server does not have security holes, exposing it to the wide Internet should be no more risky (and no less) than exposing a HTTPS Web server. With LDAPS (SSL outside, traditionally on port 636, LDAP protocol in it), the authentication requested by the server will be performed under the protection of SSL, so that's fine (provided that authentication passwords are strong, as usual).
... with one caveat nonetheless. A big part of HTTPS security is that the browser, i.e. the client, makes sure that the server's certificate is correct: verification of all signatures with regards to a set of trust anchors; revocation status checks; verification that the intended server name really appears where it should in the server's certificate. If you access the LDAPS server through some software, then that software should apply the same kind of verifications; but I doubt most LDAPS clients are that thorough.
I would not say it is common to expose LDAP services to the internett. What business case do you have to do this? Is is much like you do not want to expose your database server to the Internett. It is usually access only via. DMZ services, while your LDAP rests on the internal network. If I do Shodan search for port:389 I get no results, compared to MySQL where I get about 5528729 results. I think it is safe to say that it is not common.
As with all services you expose to the internet, the answer whether it is safe or not depends on how you harden the system. If you do not need it on the internett, dont put it there. If you do need it harden it and consider limiting access to only those who need it. E.g. if this is used for some kind of federation services I would consider only trusting connections to the LDAP from valid federation servers.
