Questions tagged [ldap]
The Lightweight Directory Access Protocol is an application protocol for reading and editing directories that follow the Directory Information Model over an IP network using unsecured TCP/IP, TLS or SSL. LDAP is a binary protocol described in terms of ASN.1 and transmitted using ASN.1 Basic Encoding Rules.
85 questions
0
votes
0
answers
13
views
LDAP Signing GPO enforced, but assessment says it is not [migrated]
Wanted to start off by saying am not familiar much with LDAP. I just want to make sure LDAP signing is enforced. I've enforced it through GPO specifically the "domain controller: LDAP server ...
0
votes
1
answer
2k
views
Perfect DMZ: LDAP auth to AD
My goal is to integrate a public facing service with AD using LDAP.
While I vouch for federated approach to user authentication, the business dictates LDAP.
We run a DMZ subnet and I insist on not ...
- 281
0
votes
0
answers
1k
views
evil-winrm error connecting
I can't connect using evil-winrm directly. But when I use exegol it works
command used:
evil-winrm -i ip -u 'user' -p 'password'
error using evil-winrm:
Error: An error of type OpenSSL::Digest::...
- 101
1
vote
1
answer
438
views
Best practice for "stateOrProvinceName" in certificate
In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
- 4,808
0
votes
0
answers
616
views
Metasploit module for NULL LDAP credentials
This article covers the solution for the LDAP challenges on a capture the flag.
I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP ...
- 211
0
votes
2
answers
539
views
How different ldap implementations are generating random salt?
I am currently generating a salted SHA 256 passwords in the below format
$hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) .
Using the below libraries of Java ...
- 125
0
votes
0
answers
19
views
Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]
(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
- 165
1
vote
1
answer
4k
views
Is LDAPS or StartTLS more secure?
This question has been asked and answered here, here, and also basically here. I'm asking again because the answers and information is conflicting.
LDAPS:
According to Wikipedia (and its RFC sources) ...
- 121
0
votes
1
answer
522
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0
votes
1
answer
881
views
How to overcome MD4 hashing in SAMBA
We are using a Samba configuration on our RedHat (RHEL7.9) systems, where SMB authentication is based on an NTLM password hash, which is basically a clear-text credential for a challenge-response ...
- 105
0
votes
0
answers
2k
views
What does LDAP have to do with X.509 Certificates
I'm working with certificates programmatically through .NET. I usually give the certificate a DN by giving it string like this: "c=eg,s=cairo,st=Nozha,cn=Foo Ltd.,..”
But there is another way to ...
- 157
0
votes
1
answer
1k
views
LDAP StartTLS encryption - which TLS versions are supported?
I am looking to set a third party application to authenticate with our domain. The application supports LDAPv3 and we have opted to use the start StartTLS extension to encrypt the credentials from the ...
- 1
3
votes
2
answers
1k
views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
- 140
0
votes
1
answer
204
views
Having a backdoor password for each user to allow impersonation
For some context, I want my api to be able to 'impersonate' (or connect as) a user on my ldap database as most of the api's access controls are on the ldap database and tied to the user you are ...
- 43
1
vote
1
answer
150
views
Is an LDAP injection possible for a basic search query?
I'm trying to secure a login endpoint by attempting to bypass the login that uses LDAP.
It employs a search query of "cn=" + username + ", dc=example, dc=com" with a filter of "(objectClass=*)".
Is ...
- 113
1
vote
1
answer
415
views
Is kerberos unconstrained delegation partially safer than constrained delegation?
When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
- 183
2
votes
1
answer
2k
views
Is LDAP encrypted after SASL authentication?
I was inspecting LDAP packets wit Wireshark today.
When I authenticate with simple bind, I can see the password in plain text and subsequent LDAP requests and responses.
Then I was authenticating ...
- 364
1
vote
0
answers
1k
views
Active Directory authentication with a Login form ASP.NET MVC5
I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
- 11
2
votes
1
answer
193
views
Partially controlling LDAP BindDN parameter
In an application I was assessing, I found an interesting piece of code that took my attacker-supplied input and put it into the bindDN while preparing to connect to an LDAP server.
[USERNAME]@domain....
- 269
1
vote
0
answers
418
views
OpenLDAP encrypt database or by attributes
I run an OpenLDAP server on which there is some data I wanted to encrypt.
I cannot use a userPassword like attributes as this is hash. In my case I need to crypt/decrypt it with a secret key.
But if ...
- 11
1
vote
1
answer
396
views
How do companies authenticate internal users in internal systems?
Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
- 69
3
votes
1
answer
3k
views
Browser not generating kerberos ticket
Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev
So, I have the following scenario:
A suite of webapps which use kerberos ...
- 83
2
votes
0
answers
502
views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
2
answers
396
views
For PCI compliance, is a central Auth required for domain and non-domain security principles?
We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
- 21
2
votes
3
answers
727
views
Best practices to prevent logging of LDAP credentials by intermediate apps
I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use.
We also have some internal web-based tools that interface ...
- 21
1
vote
0
answers
251
views
How to intercept AD authentication attempts [closed]
My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
- 111
2
votes
2
answers
613
views
Invalidate API tokens when LDAP user is invalid
I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.
User sends LDAP username and password (with password grand type) to
the server.
Server ...
0
votes
1
answer
4k
views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
- 13
1
vote
1
answer
311
views
Obfuscating password LDAP AD
I have my parameters in a properties file.
managerDn=cn=read-only-admin,dc=example,dc=com
managerPassword=69BPoqG3sWr/MNspi4ZsDw==
server=ldaps://server.local:636
groupSearchBase=ou=test,dc=example,...
- 11
0
votes
1
answer
190
views
Risks for implementing single sign on
I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0
answers
1k
views
How do I lookup the UID of a domain user?
I'm playing with golden ticket (mimikatz)
kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
- 2,097
1
vote
0
answers
348
views
LDAPS needed when using Kerberos?
In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC.
Since ...
- 11
2
votes
0
answers
714
views
Bypass of LDAP authentication
In an LDAP environment that has no Radius or SSO policy whatsoever I have been told from the corporate sysadmin that:
Machines that are not included into the domain could access resources (SAMBA) ...
- 360
0
votes
0
answers
2k
views
OpenLDAP security SSHA [duplicate]
In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA.
From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
- 1,363
2
votes
3
answers
3k
views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
- 21
2
votes
1
answer
940
views
Is it safe to store secrets in LDAP?
Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP.
Is it safe to store secret or sensitive information as an ...
- 1,630
1
vote
1
answer
903
views
What are the security best practices for clients authenticating users with password against LDAP?
To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication)....
- 111
1
vote
1
answer
472
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
1
vote
1
answer
3k
views
Sniffing ldap credentials?
I am going to performing an internal pentest. Is it possible to sniff active directory credentials using Wireshark or Ettercap when a user logs on and authenticates to using their domain credentials?
- 7
1
vote
0
answers
1k
views
LDAP (Active Directory) Authentication from DMZ
I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
- 130
1
vote
0
answers
493
views
Samba or ldap-auth-client for LDAP authentication in Ubuntu client machines
We have around 100 employees using PCs, MACs and Linux machines (Ubuntu). I want to implement a central account and user authentication solution.
I am planning to do it with Ubuntu machines first ...
- 111
4
votes
3
answers
2k
views
largely accessible encrypted passwords
Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the ...
- 43
2
votes
0
answers
1k
views
Active directory, limit permission on ldap, allow only to read self profile
Is possible to limit the visibility of a standard LDAP user?
I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile.
I tried to apply ...
- 71
1
vote
3
answers
254
views
If LDAP credentials are leaked, is IP whitelist still sufficient protection?
In a situation where LDAP credentials get leaked but there is still an IP whitelist in place...
My gut feeling says this isn't right; the credentials should be changed. Is this correct? What ...
- 115
1
vote
1
answer
160
views
SSO Understainding Credentials and Authentication [closed]
I would like to create a SSO where my users can login to machines and wordpress (php) websites.
So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
2
votes
1
answer
1k
views
Using LDAP for application authentication
Some of my colleagues want to get rid of our current inhouse application authentication, and use LDAPS to handle all of the authentication (storing passwords etc.) instead. I disagree and say that we ...
user127507
0
votes
1
answer
1k
views
DC server integrated with DNS trying to contact Blacklisted DNS hostname
Need some help in understanding below attack.
The below logs are extracted from the firewall and i could see a outbound connection from ldap server to 194.169.218.42. But walking through the logs(...
- 95
1
vote
1
answer
4k
views
Should you use Radius and LDAP together?
For example I'm reading something right now that says:
"The authentication server is a RADIUS server, which
authenticates virtual machines through a Lightweight Directory
Access Protocol (LDAP) ...
- 409
2
votes
2
answers
211
views
LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?
Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc.
It's convienient because you don't have to independantly manage authentication for ...
- 717
1
vote
1
answer
2k
views
Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)
I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO.
My initial assessment is that ...
- 267