Port 389: LDAP

What uses port 389

Applications use LDAP to look up users and groups and to check passwords against a directory such as Active Directory, OpenLDAP or FreeIPA. Plain LDAP on 389 sends bind passwords in clear text unless the connection is upgraded with StartTLS; LDAPS on 636 encrypts from the start. Microsoft now requires LDAP signing and channel binding on domain controllers by default.

Should port 389 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 389

sudo ss -ltnp 'sport = :389'
sudo ss -lunp 'sport = :389'

sudo lsof -nP -iTCP:389 -sTCP:LISTEN
sudo lsof -nP -iUDP:389

Get-NetTCPConnection -LocalPort 389 -State Listen
Get-NetUDPEndpoint -LocalPort 389
netstat -ano | findstr :389

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 389

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:389 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 389 -State Listen).OwningProcess

Allow port 389 from trusted networks only

The examples allow 389 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 389 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 389 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 389 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="389" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="389" protocol="udp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "LDAP 389/TCP" -Direction Inbound -Protocol TCP -LocalPort 389 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "LDAP 389/UDP" -Direction Inbound -Protocol UDP -LocalPort 389 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 389 from another machine

nc -zv example.com 389

Test-NetConnection example.com -Port 389

Related ports

• Port 636 (LDAPS): used by LDAP over TLS (LDAPS) for encrypted directory access.
• Port 88 (Kerberos): used by Kerberos authentication, including Active Directory logins.
• Port 445 (SMB): used by SMB for Windows file and printer sharing.
• Port 3268 (Active Directory Global Catalog): used by the Active Directory Global Catalog for forest-wide LDAP searches.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 853 (DNS over TLS) . See all ports in the port lookup.

Sources

• IANA port registry: 389

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions