LDAP Relay Attacks: Signing & Binding Guide

LDAP Signing - Protecting Port 389

LDAP signing adds cryptographic signatures to LDAP packets, ensuring:

• ✓ Authentication integrity - Verifies client and server identities
• ✓ Data integrity - Prevents packet modification in transit
• ✓ Tamper protection - Invalidates altered packets

Result: Domain controllers reject any LDAP communication without a valid signature.

LDAP Channel Binding - Protecting Port 636

Channel binding secures LDAPS traffic by:

• ✓ Binding authentication to TLS - Links encrypted connection to authentication
• ✓ Preventing relay attacks - Captured credentials can't be used on different connections
• ✓ Validating certificates - Ties authentication to specific server certificate

Result: Even if credentials are captured, they cannot be relayed over different TLS connections.

Step 1: Open Group Policy Management

gpmc.msc → Navigate to Domain Controllers OU

Step 2: Create New GPO

Right-click Domain Controllers OU
→ "Create a GPO in this domain, and Link it here"
→ Name: "Domain Controller - LDAP Hardening"
→ Right-click → Edit

Step 3: Navigate to LDAP Settings

Computer Configuration
→ Policies
→ Windows Settings
→ Security Settings
→ Local Policies
→ Security Options

Step 4: Enable LDAP Server Signing

Policy: "Domain controller: LDAP server signing requirements"
Setting: "Require signing"
→ Apply → OK

Step 5: Enable Channel Binding

Policy: "Domain controller: LDAP server channel binding token requirements"
Setting: "Always"
→ Apply → OK

Step 6: Apply Configuration

# On each domain controller
gpupdate /force

# Verify policy application
gpresult /h C:\GPResult.html

Registry Path

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Automated Monitoring Script

Use this PowerShell script to check for unsigned LDAP bind attempts in the last 24 hours. Run this regularly (daily or weekly) to identify systems that need updating before they cause authentication failures.

# Check for unsigned attempts in last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName='Directory Service'
    ID=2889
    StartTime=(Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Message

# Optional: Export to CSV for analysis
Get-WinEvent -FilterHashtable @{
    LogName='Directory Service'
    ID=2889
    StartTime=(Get-Date).AddDays(-1)
} | Select-Object TimeCreated, @{Name='ClientIP';Expression={
    if($_.Message -match 'Client:\s+(.+)') {$matches[1]}
}} | Export-Csv -Path "C:\LDAP_Unsigned_Binds.csv" -NoTypeInformation

Pro tip: Schedule this as a daily task and alert your security team when events are detected. This helps you proactively identify legacy systems before enforcement.

Will this break anything?

In modern environments, no. All supported Windows operating systems and most enterprise applications support LDAP signing. However:

• Test in non-production first
• Very old applications (10+ years) may have issues
• Plan a maintenance window for initial deployment

Do I need both LDAP signing AND channel binding?

Yes, absolutely. They protect different attack vectors:

• LDAP Signing protects port 389 (standard LDAP)
• Channel Binding protects port 636 (LDAPS)

Attackers will exploit whichever protection is missing.

How do I know if I'm vulnerable?

Check with:

• NetExec LDAP checker module
• Registry value verification on each DC
• Professional penetration testing
• Event ID 2886 in Directory Services logs