# WHATPORT(389)

## NAME

port 389 — LDAP — LDAP directory service, cleartext or STARTTLS, TCP 389.

Protocol: TCP  
IANA registry

## DESCRIPTION

Directory servers — OpenLDAP slapd, Active Directory domain controllers, 389 Directory Server — listen on TCP 389 for bind, search, and modify operations. OpenLDAP's default listener URL is ldap:/// which means LDAP over TCP on all interfaces on port 389. On a scan it usually marks a domain controller or an identity store that applications authenticate against. Port 636 is the separate implicit-TLS listener (ldaps://); 389 itself is cleartext unless the client negotiates STARTTLS.

## EXPOSURE

**Do not expose.** A simple bind on 389 without STARTTLS sends the username and password in cleartext, and anonymous binds often leak the whole directory tree.

## CHECK

```sh
ldapsearch -x -H ldap://DC_HOST:389 -s base -b "" namingContexts
```

## SEE ALSO

- spec — [RFC 4511 — LDAP: The Protocol](https://datatracker.ietf.org/doc/html/rfc4511) (datatracker.ietf.org)
- docs — [OpenLDAP 2.6 Administrator's Guide — Running slapd](https://www.openldap.org/doc/admin26/runningslapd.html) (openldap.org)
- source — [OpenLDAP (GitHub mirror)](https://github.com/openldap/openldap) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/389/> · JSON: <https://whatport.net/389.json> · full dataset: <https://whatport.net/ports.json>