skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

configuring-ldap-security-hardening

Audit LDAP services for LDAPS, signing, anonymous binding, and channel binding.

2|Updated Apr 14, 2026
Search Tags:#iam#hardening#security-audit#ldap#ldaps#channel-binding#anonymous-enumeration
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill configuring-ldap-security-hardening
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configuring-ldap-security-hardening
Source: https://github.com/Acczdy/MoZiSec/tree/main/iam/.claude/skills/configuring-ldap-security-hardening
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill configuring-ldap-security-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ldap3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill hardens LDAP directory services to reduce the risk of credential harvesting, anonymous enumeration, LDAP injection, and channel binding bypass, helping teams close common identity and directory attack vectors.

Core Features & Use Cases

  • Automated Checks: Detects LDAPS availability, LDAP signing enforcement, anonymous rootDSE exposure, and channel binding configuration.
  • Actionable Recommendations: Maps findings to registry/GPO settings and provides remediation guidance for AD and LDAP servers.
  • Use Case: Run the audit in a test environment before deploying GPO changes to ensure LDAPS, signing, and channel binding are correctly enforced and documented for compliance.

Quick Start

Use the configuring-ldap-security-hardening skill to audit ldap.example.com and save the findings to ldap-report.json.

Frequently Asked Questions about configuring-ldap-security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden LDAP to prevent credential theft in Active Directory?▼

To harden LDAP and prevent credential theft, you must enforce LDAPS availability, LDAP signing, and channel binding while disabling anonymous rootDSE enumeration to close common identity and directory attack vectors.

What is LDAP channel binding bypass and how do I check for it?▼

LDAP channel binding bypass is an attack vector that circumvents secure LDAP protections. You check for it by auditing channel binding configuration and mapping findings to registry or GPO settings for remediation.

How do I stop anonymous LDAP enumeration on my directory servers?▼

To stop anonymous LDAP enumeration, you audit anonymous rootDSE exposure and apply configuration hardening recommendations that map to registry and GPO settings for your Active Directory or generic LDAP servers.

Does the ldap3 library work for auditing LDAPS and LDAP signing?▼

Yes, the ldap3 dependency supports automated checks for LDAPS availability and LDAP signing enforcement to help teams perform security assessments and compliance remediation.

When should I run an LDAP security audit before deploying GPO changes?▼

You should run an LDAP security audit in a test environment before deploying GPO changes to ensure LDAPS, signing, and channel binding are correctly enforced and documented for compliance.

Related Skills

Explore More Software Engineering Skills→
openeuler-mirroropeneuler-mirror
3

tls-certificate-diagnosis

Diagnose TLS/SSL handshake failures and certificate chain issues with OpenSSL.

Official
Advanced
christopheraaronhoggchristopheraaronhogg

nehemiah-compliance

Evaluate GDPR and CCPA compliance to produce structured assessment reports.

Community
Advanced
AndyAnh174AndyAnh174

Windows Privilege Escalation

Enumerate Windows systems and exploit privilege escalation vulnerabilities.

Community
Advanced
bpnrockstarbpnrockstar

hunt-ldap

Detect and exploit LDAP and XPath injection vulnerabilities in authentication mechanisms.

Community
Advanced