DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 833163858D32
Message-ID: <ae73845c-b970-37ab-f429-65b15cf8540c@tu-dortmund.de>
Date: Sun, 22 Jan 2023 15:32:27 +0100
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: observation: masses of requests to LDAP
From: Tobias Wendorff via Cygwin <cygwin@cygwin.com>
Reply-To: Tobias Wendorff <tobias.wendorff@tu-dortmund.de>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

Hi there,

our IT department has informed me that masses of requests are being sent 
from my computer to our two LDAP servers on port 389. After a detailed 
investigation, the problem could be clearly traced back to "cygwin".

Firewall logs show that about any tool, even base tools "sort" or 
"less", initiates a request to port 389 on our LDAP servers.

Sorry, I am _not_ going to release "cygcheck.out" to public, since it 
contains sensitive information about the domain and its groups and 
memberships.

Even after reinstalling cygwin from another server, the problem still 
appears. Could it be that this is part of an attack?

Best regards,
Tobias

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple