If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000185

SV-63365r1_rule If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

Vulnerability discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

Check content

Verify the source of the LDAP certificates Check if the system is using NSS LDAP. # grep -v '^#' /etc/nsswitch.conf | grep ldap If no lines are returned, this vulnerability is not applicable. Verify with the SA that the system is connected to the GIG. If the system part of a standalone network which is not connected to the GIG this vulnerability is not applicable. Verify a certificate is used for client authentication to the server. # grep -i '^tls_cert' /etc/ldap.conf If no line is found, this is a finding. List the certificate issuer. # openssl x509 -text -in If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Fix text

Edit "/etc/ldap.conf" and add or edit the 'tls_cert' setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.