Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to support Mac clients who need to access a LDAP server to locate SMIME keys.

Since the keys are already in AD, and it's easy for me to create a RODC or read only forest where I push the certificates to, is it acceptable to expose unauthenticated LDAP and LDAPs to the internet?

One issue I can think of is an LDAP form of a directory harvest attack, where a spammer could determine which addresses are valid and which aren't.

share|improve this question
up vote 12 down vote accepted

It depends completely on what's in the LDAP directory.

For Active Directory, absolutely not, even for an RODC - the security profile of these devices is designed for being inside your network (the RODC specifically is hardened against physical compromise, so you can keep it in a closet - a physical compromise of a normal DC would give an attacker control of the domain and all users' password hashes).

An attacker could gain a mountain of information from AD - usernames to try to authenticate with, system names, some amount of network topology.. if not enough to attack with directly (password attacks against a different public endpoint, like VPN?), certainly enough to put together a solid social engineering or spear phishing attack.

share|improve this answer
In the solution I propose above, AD happens to be serving the LDAP data, and I'm leveraging its ability to replicate and do LDAP stuff. There will be no user accounts, other than a renamed Administrator account with a 2 factor password and disabled guest account. I'm considering editing the ACLs of all containers so that enumeration by anonymous users is not possible. Just direct queries. – LamonteCristo Mar 5 '14 at 1:44
If your AD is that empty, why not just use simple LDAP? – mfinni Mar 5 '14 at 2:05
@mfinni - I don't know linux, and am very comfortable with all the nuances of AD... – LamonteCristo Mar 5 '14 at 12:03
@makerofthings7 - I didn't even whisper the word "linux". There's plenty of LDAP server implementations for any OS you care to name. Microsoft has one, similar to AD, called AD LDS (formerly ADAM.) That would be better, in almost all cases. Exposing Active Directory to the internet, via LDAP, exposes sensitive information. It's nothing that wouldn't be available to a LAN-connected client, and if your AD truly contains nothing you don't mind exposing, then go for it. It's not generally acceptable though, which was your stated question. – mfinni Mar 5 '14 at 13:34
Yes, ADAM seems like a fit for this. I totally forgot about it, despite working with it for years. – LamonteCristo Mar 5 '14 at 18:29

No, it would not be generally acceptable. Not sure what you are trying to achieve but I would say the correct way is to first establish a VPN connection and then connect to LDAP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.