Port 389LDAP
The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral protocol used to query and manage directory services over a network. It facilitates centralized authentication, authorization, and directory-based lookups, serving as a backbone for enterprise identity management and access control. LDAP powers a wide array of services including corporate user directories, email systems, and network resource lookups..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 5/10
- lookups
- 8,238
2 transports registered
payload readable on path
registered with iana
caution
rank 610 of 993 · top 61%
Technical Details
what runs on :389LDAP, standing for Lightweight Directory Access Protocol, is designed as a lightweight alternative to the X.500 Directory Access Protocol, enabling efficient querying and modification of directory information over an IP network. It operates primarily over port 389, utilizing both TCP and UDP as transport protocols. The LDAP information model is based on data stored in hierarchical, tree-like structures known as directory information trees (DITs), which organize entries representing users, groups, devices, and other objects.
Clients communicate with an LDAP directory server using a well-defined protocol that supports search, read, add, delete, and modify operations. It provides for extensible schema definitions to describe various object classes and attributes, enabling flexible and powerful directory designs. LDAP servers like OpenLDAP, Microsoft Active Directory, and Apache Directory Server implement the protocol to enable integration with a range of applications.
Because it is a fundamental component of authentication and authorization systems, LDAP is a key part of enterprise network infrastructures. While originally designed to be used without encryption, LDAP is often paired with protocols such as StartTLS (on the same port) or LDAPS (over port 636) to secure communications.
Security Information
exposure of :389risk score
5/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 1.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
LDAP security concerns include:
- Unencrypted traffic: By default, LDAP communications on port 389 are sent in plaintext, exposing credentials and sensitive directory information to eavesdropping.
- Anonymous binds: Misconfigured servers that permit anonymous binds can leak directory data.
- Injection attacks: Unsanitized inputs in LDAP queries can lead to LDAP injection vulnerabilities, allowing unauthorized information retrieval or privilege escalation.
- Improper access controls: Weak access policies may allow users excessive privileges or enable data leakage.
Mitigations include:
- Enforcing encrypted communications via StartTLS or migrating to LDAPS over port 636.
- Disabling anonymous binds and requiring authentication for all directory queries.
- Applying strict input validation and escaping special characters in directory queries to prevent injections.
- Implementing least privilege principles, role-based access controls, and frequent audits of directory permissions.
- Regular patching and monitoring LDAP servers for suspicious activities.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted