Home / server / Questions / 682594
Accepted
Itai Ganot
Asked: 2015-04-15 05:36:03 +0800 CST

Which ports are required in order to authenticate against a ldap server in another domain which is behind a firewall?

  • 772

I have a Linux domain running with sssd, let's call this domain NJ.

I'd like machines on the NJ domain to be able to authenticate against an Active Directory ldap server which resides on a different domain (called NY) which is behind a firewall.

Would it be enough to allow only port 389 between both domains or are there any other ports which are required in order for the machines on the NJ domain to authenticate against ldap servers in the NY domain?

active-directory

4 Answers

  1. You should use TCP ports 389 and/or 636. Port 636 is for LDAPS, which is LDAP over SSL. Encryption on port 389 is also possible using the STARTTLS mechanism, but in that case you should explicitly verify that encryption is being done.

    Microsoft's KB article says:

    • Start TLS extended request

      LDAPS communication occurs over port TCP 636. LDAPS communication to a global catalog server occurs over TCP 3269. When connecting to ports 636 or 3269, SSL/TLS is negotiated before any LDAP traffic is exchanged. Windows 2000 does not support the Start TLS extended-request functionality.

    Also see the related Server Fault question.

    • 13
  2. Best Answer

    As long as it LDAP auth only (and not AD/Kerberos etc.), 389 should be sufficient.

    • 4

  3. This really depends on SSSD configuration, in particular auth_provider. auth_provider=ldap requires either port 389 (with TLS) or 636 (ldaps). auth_provider=krb5 requires port 88.

    ipa and AD providers require both actually, because even identity data is encrypted with GSSAPI, so you need port 88 to prime the ccache to do a GSSAPI LDAP bind, then port 389 to search LDAP and then also again port 88 for authentication.

    IPA and AD providers also rely heavily on DNS, so port 53 might be appropriate as well.

    • 1

  4. SSSD can be configured to retrieve user information from the Active Directory Global Catalog. That would require port 3268 https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server

    If you will access any SAMBA shares, then dynamic ports will be necessary to verify access to folders before opening them.

    This TechNet document lists all potential ports, depending on the features you will use. It also has a link to restricting dynamic ports if you want to limit the number of potential ports. https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx

    • 1