How do I identify insecure LDAP connections?


I'm trying to identify insecure connections to our LDAP server. We're using OpenLDAP, and I want to exclude connections which use STARTTLS or port 636.

Tags (3)
0 Karma


I found a possible solution using the ssf value (security strength factor). When StartTLS or SSL is used, the ssf is greater than 0. But the ssf value is logged as 0 at other points when the connection is secure. By finding connections where ssf < 128, you can filter out the secure connections.

source="YOUR-LDAP-SOURCE" | transaction conn maxpause=5m | search ssf<128 | top uid

By using the transaction command you can group the individual connection sequences by the conn attribute, then search for those with a lower ssf AES bit encryption.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...