If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate and this certificate has a valid trust path to a trusted CA.

From AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: DCNR-1

Associated with: CCI-000185

SV-38966r1_rule If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate and this certificate has a valid trust path to a trusted CA.

Vulnerability discussion

The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.

Check content

Check if the system is using LDAP authentication. #grep LDAP /etc/security/user If no lines are returned, this vulnerability is not applicable. Verify SSL is enabled. #grep '^useSSL' /etc/security/ldap/ldap.cfg If yes is not the returned value, this is a finding. Verify a server certificate is required and verified by the LDAP configuration. #grep -I '^ldapsslkeyf' /etc/security/ldap/ldap.cfg Make note of the key database file location. #gsk7cmd -cert -list CA -db -pw Make note of the Key Label. #gsk7cmd -cert -details -showOID -db -pw -label THE IBM GSK Database should only have certificates for the client system and for the LDAP server. If more certificates are in the key database than the LDAP server and the client, this is a finding.

Fix text

Install a certificate signed by a DoD PKI or a DoD-approved external PKI. #gsk7cmd < or > ikeyman Remove un-needed CA certificates. #gsk7cmd < or > ikeyman

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.