SSL/TLS

ControlUp’s Realtime DX Console and Monitor components currently use LDAP (Lightweight Directory Access Protocol) on port 389 to communicate with Active Directory for essential functions such as reading the domain’s organizational structure, discovering computers, and retrieving user and group information. This communication method is explicitly documented in ControlUp’s support materials. While security teams often prefer LDAPS (LDAP over SSL/TLS) on port 636 to secure directory queries, ControlUp’s product does not automatically fall back from LDAP to LDAPS if port 389 is closed or blocked. The reliance on LDAP instead of LDAPS is outlined in ControlUp’s official documentation, including the Communication Ports for VDI environments, particularly for the EU region. These documents confirm the use of LDAP on port 389 as a mandatory communication channel for the Console and Monitor to function correctly. Attempting to restrict access by only allowing LDAPS traffic on port 636 without open access on port 389 will disrupt domain querying operations and break functionality. There is currently no straightforward option within ControlUp to switch these queries from LDAP to LDAPS. The documentation and community experts note that closing port 389 and permitting only port 636 is not supported and will result in operational issues. This limitation is important for network and firewall teams to understand when reviewing and tightening rules related to ControlUp’s network communication. For detailed information on required ports and communication flows, ControlUp provides a dedicated documentation page at https://support.controlup.com/docs/communication-ports-used-by-controlup-hybrid-cloud-eu-customers, which includes tables and descriptions of mandatory ports for the Console and Monitor roles. Users seeking secure directory communication should be aware of this existing protocol limitation and plan network configurations accordingly to avoid disruptions.

Read the entire article here...

---