Port 389 (LDAP)

Lightweight Directory Access Protocol: Active Directory, OpenLDAP and FreeIPA directory queries and binds. UDP 389 is used by AD for domain controller discovery (CLDAP).

Well-known (system) port, 0-1023 TCPUDP Directory and authentication Do not expose to the internet

What port 389 is used for

Lightweight Directory Access Protocol: Active Directory, OpenLDAP and FreeIPA directory queries and binds. UDP 389 is used by AD for domain controller discovery (CLDAP).

Security: should port 389 be open?

Do not expose to the internet. Do not expose. Simple binds on 389 send passwords in clear text unless StartTLS is used, anonymous binds can leak the directory, and open CLDAP on UDP 389 has been used for amplification DDoS. Require LDAP signing and channel binding on AD.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ldap TCP Lightweight Directory Access Protocol Tim Howes -

ldap UDP Lightweight Directory Access Protocol Tim Howes -

Check what is listening on port 389

Linux: is anything listening on TCP 389?

sudo ss -tlnp 'sport = :389'

Linux: UDP 389

sudo ss -ulnp 'sport = :389'

Linux / macOS: which process owns the port

sudo lsof -nP -i :389

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':389 '

Windows (Command Prompt)

netstat -ano | findstr :389

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 389 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 389

From Windows

Test-NetConnection HOST -Port 389

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 389

Block port 389 in the firewall

ufw

sudo ufw deny 389/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 389 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 389 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 389' -Direction Inbound -Protocol TCP -LocalPort 389 -Action Block

ufw

sudo ufw deny 389/udp