What it is
Account/authentication directories such as LDAP and Kerberos.
Why it is risky
Cleartext LDAP (389) exposure enables account enumeration and credential theft.
What to do
Enforce LDAPS (636) / signing and keep the directory on internal networks.
Is it listening on your server?
Linux
ss -ltnp 'sport = :636'Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.