Common attacks and weaknesses
- Same directory exposure as LDAP if reachable from untrusted networks.
- Expired or self-signed certificates disabling validation in clients.
Port 636: LDAPS
LDAP over TLS.
636
How LDAPS works
Directory & authenticationThe client proves who it is on port 636 and gets an answer (or a ticket) it can use with other services. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP
- Exposure risk
- 5/10 moderate if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Directory & authentication
Is port 636 dangerous?
How to secure it
- Restrict to internal networks.
- Use certificates from an internal PKI and enforce validation.
IANA registry entries for port 636
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ldaps | 636 | TCP, UDP | ldap protocol over TLS/SSL (was sldap) | - | - |
// source: IANA service name and port number registry
Which program uses port 636, and is it reachable?
Linux
sudo ss -ltnup 'sport = :636' # process listening on 636
sudo lsof -nP -i :636macOS
sudo lsof -nP -i :636
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 636 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 636 netstat -ano | findstr :636
From another machine
nmap -p 636 -sV <host> sudo nmap -sU -p 636 <host> nc -zv <host> 636
Block it in the firewall
sudo ufw deny 636/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 636" -Direction Inbound -LocalPort 636 -Protocol TCP -Action Block # Windows
What is port 636 used for?
LDAP over TLS.
Is port 636 TCP or UDP?
Port 636 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 636?
It is rated 5/10 (moderate) when exposed to the Internet. Same directory exposure as LDAP if reachable from untrusted networks. Restrict to internal networks.
How do I check if port 636 is open?
On Linux run "ss -ltnup 'sport = :636'", on macOS "lsof -nP -i :636", and on Windows "netstat -ano | findstr :636" to see the local process. From another machine, "nmap -p 636 <host>" shows whether it is reachable.
Other directory & authentication ports
:389 LDAP tcp · udp · high risk :88 Kerberos tcp · udp · high risk :3268 Global Catalog (LDAP) tcp · udp · high risk :1812 RADIUS udp · tcp · moderate risk :31 MSG Authentication tcp · udp :49 Login Host Protocol (TACACS) tcp · udp :56 XNS Authentication tcp · udp :113 Authentication Service tcp · udp