LDAP directory service, cleartext or STARTTLS, TCP 389.
Directory servers — OpenLDAP slapd, Active Directory domain controllers, 389 Directory Server — listen on TCP 389 for bind, search, and modify operations. OpenLDAP's default listener URL is ldap:/// which means LDAP over TCP on all interfaces on port 389. On a scan it usually marks a domain controller or an identity store that applications authenticate against. Port 636 is the separate implicit-TLS listener (ldaps://); 389 itself is cleartext unless the client negotiates STARTTLS.
Do not expose
A simple bind on 389 without STARTTLS sends the username and password in cleartext, and anonymous binds often leak the whole directory tree.
$ ldapsearch -x -H ldap://DC_HOST:389 -s base -b "" namingContextsSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.