A little something about everything

internet marketing and website development made simple..

Exploitable LDAP server used for an attack: Microsoft Active Directory / Exchange Server

You've just received notice that your Active Directory server is being used as part of a wide scale dDoS attack. Here is how you can fix it.

Go to the firewall settings on the active directory server or reported server IP and look for the following rules.

  • Active Directory Domain Controller - LDAP (TCP-In)
  • Active Directory Domain Controller - LDAP (UDP-In)
  • Active Directory Domain Controller - LDAP for Global Catalog (TCP-In)
  • Active Directory Domain Controller - Secure LDAP (TCP-In)
  • Active Directory Domain Controller - Secure LDAP for Global Catalog (TCP-In)

For each of these alter the rule by choosing the Scope tab and entering only IP addresses that should have access to LDAP information. For example, Microsoft Exchange Servers within your network that need access to LDAP.

For assistance securing your network or if you are looking for hosted exchange services check out Area51.mn.