zeronetworks / ldapfw Goto Github PK

Installed ldapfw but still says uninstalled, try to re-install and lsass crashes. This is running on Server 2019.

Faulting application name: lsass.exe, version: 10.0.17763.3532, time stamp: 0xcda34c13
Faulting module name: KERNELBASE.dll, version: 10.0.17763.4377, time stamp: 0x4c0e81b1
Exception code: 0xe06d7363
Fault offset: 0x00000000000349b9
Faulting process id: 0x2d0
Faulting application start time: 0x01d9e8c1f9428b1f
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: 5bb2ccba-299a-4ca6-ba66-2514240c5d41
Faulting package full name:
Faulting package-relative application ID:

Hi there,

I played with ldapfw in the lab today and it's really cool. Nice work!

Could you give me a config example where you want to allow one user (can you allow a group?) to add a machine to the domain, but nobody else? Should something like this work? It doesn't appear to:

{
    "rules": [
      {
            "operations": ["add"],
            "ips": ["*"],
            "users": ["testuser1"],
            "action": "allow"
        },
        {
            "operations": ["add"],
            "ips": ["*"],
            "users": ["*"],
            "action": "block"
        },
        {
            "operations": ["*"],
            "ips": ["*"],
            "users": ["*"],
            "action": "allow"
        }
    ],
	"suppressAudit": ["search"]
}

Hi Team,

Since I have got around 20+ rules in my config file going forward I am not sure how do I remember those and purpose of it. Hence would it be possible to write a comment in file for the purpose of why this rule was written and any other comments I need to write?

TIA
Blason R

Receiving this error when trying to install. /status before and after shows "ready to install: True" and doesn't seem to install.

Finished configuring the Event Log.
Installing LDAP Firewall...
Error when calling VirtualAllocEx 5
Loading LDAP Firewall configuration...