Anonymous LDAP Binds 1

[RoderickM]

We recently had a 3rd party security company do an internal penetration test on our Windows 2000 AD domain. One of the things that they found was that our domain controllers were allowing anonymous LDAP binds. I can not find any information on how to disable this and what the results may be. Any ideas?

 

[Tekmazter]

Well, first...this changes in Windows 2003 servers:

http://support.microsoft.com/default.aspx?scid=kb;en-us;326690

Second, there are a lot of anonymous things that can be done in Windows 2000 ... anonymous binds are one of them:

A quick explanation here:

http://esikker.dk/vul_10723.php

and here:

http://www.securityspace.com/smysecure/catid.html?id=10723

Do the opposite to Windows here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;320528

Also, this is all very similar to enumerating SIDS on user accounts using null sessions. Check out the NTWardoc online. Google it. While they didn't mention you have this open, it would be a worthy read to better explain anonymous binds and logins.

 

[ITPangaeaArchitect]

computer config\windows settings\security settings\local policies\security options

you will see items in there for disabling alot of security and enabling...be careful though

u can disable in here

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[RoderickM]

Tekmazter,

Thanks for all of the info. It looks like for me that the risk of loss of production is higher than the vulnerability. ISS considers this a low risk, but to correct it is a high risk for me since we have some NT4 systems on our domain.

 

[ITPangaeaArchitect]

yes you need it disabled then

keep your current config

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there