2

Thanks for clicking, I'm having an issue with our server where our Active Directory is being abused by random external servers.


From what I can gather, our server is the victim of an LDAP forwarding attack used in DDOS'ing, unfortunately our network is the one being taken down (Attackers abuse exposed LDAP servers to amplify DDoS attacks )

Articles suggest activating Allow the Connection if it is Secure in the windows firewall for Active Domain Controller - LDAP (UDP-In), which works, but also prevents Active Directory from working on everything else such as external Remote Desktop connections, and it even seems to prevent local network users from connecting to our local MS Exchange email server.

What I'd love to know is how to block these connections without blocking our own systems.

Thanks for reading, I'd love to hear your thoughts.

Improve this question
5
  • Don't you have an external firewall? That would be usual place to block this sort of attack.
    – Harry Johnston
    Jul 16, 2018 at 0:18
  • @HarryJohnston We still want to be able to access those ports for things such as Remote Desktop. Requiring a secure connection seems to fix it for everyone else, but I'd like to be able to still have remote desktop be accepted as a secure connection.
    – Craig White
    Jul 16, 2018 at 0:56
  • 2
    I'm fairly sure Remote Desktop clients don't need to have LDAP access to the domain controllers, though you should really be using a VPN anyway.
    – Harry Johnston
    Jul 16, 2018 at 0:58
  • @HarryJohnston ah okay, so it's likely something else is failing when I change this setting. Our setup is one physical server which acts as our domain controller and network storage, then two virtual servers, an exchange server and a terminal server which is the one they log into. Perhaps the firewall is blocking that server?
    – Craig White
    Jul 16, 2018 at 1:31
  • 1
    Blocking LDAP via Windows Firewall could certainly break lots of stuff, depending on how the rest of the network is configured. But I don't see how blocking LDAP at the external firewall could cause you any problems.
    – Harry Johnston
    Jul 16, 2018 at 1:48

1 Answer 1

Reset to default
3

DO NOT EXPOSE A DOMAIN CONTROLLER TO THE INTERNET. ON ANY PROTOCOL.

Sorry for the shouting, but honestly, get your firewall blocking any connections to your DC that are not from internal networks.

You should be using RDP over VPN as well. (RDP will auth to your DC over the internal network in either case)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .