DumbMonit
IntegrazioniSicurezza e identità
Monitorare Active Directory con DumbMonit
A Windows domain over LDAP, read-only: domain controllers and FSMO roles, privileged group members, password policy, and security findings such as Kerberos-roastable accounts, unconstrained delegation or an old krbtgt password.
DocumentazioneSito ufficiale: Active Directory
Le descrizioni sono in inglese, come nel prodotto. Le etichette della pagina seguono la tua lingua.
Cosa controlla DumbMonit
A Windows domain over LDAP, read-only: the domain controllers and who holds each FSMO role, the members of the privileged groups, the password policy, account counts, and the raw security facts an audit looks for first — accounts open to Kerberoasting or AS-REP roasting, unconstrained delegation, an old krbtgt password, computers without LAPS, Windows releases out of support. DumbMonit binds with a dedicated service account that is a plain domain user, member of no group. In Active Directory every authenticated user can read what DumbMonit reads; no administrative right is needed, and none should be given. DumbMonit never writes to the directory, never reads a password attribute (of LAPS it…
Uso tipico. Windows domain over LDAPS: domain controllers and FSMO roles, privileged group members, password policy, security findings
Esempi
- Windows Server domain controller
- Samba AD domain controller
Come si collega
Cosa serve
- Service accountA plain domain user created for DumbMonit, member of no group.
Porte di rete da aprire
636/TCPLDAPS (default), also to the other domain controllers389/TCPOnly with the StartTLS or plain LDAP option53/UDPOnly with the DNS servers option53/TCPOnly with the DNS servers option
Passaggi di configurazione: Create a read-only service account for DumbMonit
Active Directory Users and Computers → your domain → Users → New → User: name it as follows, set a long random password and add it to no group.
svc-dumbmonitOn its Account tab, tick Password never expires, or the bind fails the day the password does.
Optional, to see inbound replication status: grant the account the right listed below on the domain object.
dsacls "DC=corp,DC=example,DC=com" /G "CORP\svc-dumbmonit:CA;Monitor active directory replication"For LDAPS, export your certification authority's certificate as Base-64 encoded X.509 and paste it as CA certificate below.
In DumbMonit, enter a domain controller's name as its certificate names it (dc1.corp.example.com) and log in as [email protected].
Attenzione. Plain LDAP on port 389 sends the password in clear and is refused by default: use LDAPS, or StartTLS on port 389.