LDAP Firewall Tutorial: Audit and Block LDAP Attacks on Domain Controllers

Summary

The LDAP Firewall is a free, open-source tool from Zero Labs, Zero Networks’ research team, that audits and controls LDAP requests to domain controllers, helping mitigate LDAP-based attacks and tightly control access to Active Directory. This tutorial shows how to install it, configure firewall-style allow and block rules, read its audit events in the Windows Event Viewer, and block a real-world sAMAccountName spoofing attack by blocking LDAP add operations. The tool is available on GitHub and is also built into Zero Networks Segment.

Key takeaways

• The LDAP Firewall installs on domain controllers and is managed with a single executable that installs, updates, and uninstalls it.
• Rules work like a classic firewall: each rule matches on conditions such as operation, source IP, user, distinguished name, attribute, or search filter, and the first matching rule’s allow or block action applies.
• If no rule matches, the operation is allowed by default, and noisy search operations are excluded from auditing unless you enable them.
• Each audited operation appears in the Windows Event Viewer with the user account, the action taken, LDAP operation data, and network information.
• Blocking LDAP add operations stops the sAMAccountName spoofing attack, and allow rules placed before the block rule can still permit specific IPs.

[00:00] Narrator: The LDAP Firewall is an open-source tool from Zero Labs that lets you control and audit LDAP requests to protect domain controllers, mitigate LDAP-based attacks, and tightly control access to Active Directory. The tool is available on the Zero Networks GitHub repository and is also available as a feature of our flagship product, Zero Networks Segment. In this video, we’ll focus on the open-source version of the LDAP Firewall.

How do you install and configure the LDAP Firewall?

[00:28] The LDAP Firewall manager executable is used to start, stop, and control the tool. Using the help flag, we can see all the available commands. The status command helps make sure all prerequisites are met and the tool is ready to be installed.

[00:45] Before we install it, let’s look at the firewall configuration file. The first section specifies a list of rules, similar to a classic firewall. Each rule can be defined with a list of conditions, such as operation, source IP, and user, and an action to take: either allow or block. We can also define LDAP-specific fields, such as the distinguished name, attribute, and search filter, for an incoming LDAP operation. The action of the first matching rule applies. If no rule matches, the operation is allowed by default.

[01:20] The suppress audit section disables audit events for specific LDAP operations. By default, search operations aren’t logged, because they can be quite noisy, but they can be enabled by removing that entry from the list. Now that we’re ready to start the firewall, let’s run the install command.

How does LDAP Firewall auditing work?

[01:42] We can use the Windows LDP tool on another host to run some LDAP queries and see the tool in action. Here, we’ll perform a modify operation to change the display name of an existing user.

[02:05] If we open the Event Viewer on the server, we’ll see a new source for the LDAP Firewall, and in it, a logged event for the modify operation. The event includes fields such as the user account name, the action taken by the firewall, LDAP operation data, and network information.

How can the LDAP Firewall block a sAMAccountName spoofing attack?

[02:26] Let’s see how we can use the LDAP Firewall to block a real-world attack. The sAMAccountName spoofing attack relies on adding a new computer object using LDAP. To mitigate it, we can create a new LDAP Firewall rule that blocks all incoming add operations. Now let’s reload the LDAP Firewall configuration by running the update command.

[02:53] To simulate the attack, we’ll use the [TODO: tool name] add computer command, which will fail, thanks to the LDAP Firewall. Back on the server, we can now see the blocked event in the Event Viewer.

[03:10] Of course, in a real environment, we might need to be more specific with our rule conditions. For example, we could permit specific IPs to perform add requests by adding allow rules before our block rule.

How do you remove the LDAP Firewall?

[03:24] Finally, if we want to remove the LDAP Firewall protection, we can simply use the uninstall command.

[03:33] We hope this video has been informative and helps you get started with the LDAP Firewall. If you have any questions about the LDAP Firewall or any of our other open-source tools, check out our blog at zeronetworks.com/blog, or reach out to us at support@zeronetworks.com.