2

Thanks for clicking, I'm having an issue with our server where our Active Directory is being abused by random external servers.


From what I can gather, our server is the victim of an LDAP forwarding attack used in DDOS'ing, unfortunately our network is the one being taken down (Attackers abuse exposed LDAP servers to amplify DDoS attacks )

Articles suggest activating Allow the Connection if it is Secure in the windows firewall for Active Domain Controller - LDAP (UDP-In), which works, but also prevents Active Directory from working on everything else such as external Remote Desktop connections, and it even seems to prevent local network users from connecting to our local MS Exchange email server.

What I'd love to know is how to block these connections without blocking our own systems.

Thanks for reading, I'd love to hear your thoughts.

5
  • Don't you have an external firewall? That would be usual place to block this sort of attack. – Harry Johnston Jul 16 '18 at 0:18
  • @HarryJohnston We still want to be able to access those ports for things such as Remote Desktop. Requiring a secure connection seems to fix it for everyone else, but I'd like to be able to still have remote desktop be accepted as a secure connection. – Craig White Jul 16 '18 at 0:56
  • 2
    I'm fairly sure Remote Desktop clients don't need to have LDAP access to the domain controllers, though you should really be using a VPN anyway. – Harry Johnston Jul 16 '18 at 0:58
  • @HarryJohnston ah okay, so it's likely something else is failing when I change this setting. Our setup is one physical server which acts as our domain controller and network storage, then two virtual servers, an exchange server and a terminal server which is the one they log into. Perhaps the firewall is blocking that server? – Craig White Jul 16 '18 at 1:31
  • 1
    Blocking LDAP via Windows Firewall could certainly break lots of stuff, depending on how the rest of the network is configured. But I don't see how blocking LDAP at the external firewall could cause you any problems. – Harry Johnston Jul 16 '18 at 1:48
3

DO NOT EXPOSE A DOMAIN CONTROLLER TO THE INTERNET. ON ANY PROTOCOL.

Sorry for the shouting, but honestly, get your firewall blocking any connections to your DC that are not from internal networks.

You should be using RDP over VPN as well. (RDP will auth to your DC over the internal network in either case)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.