If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

From AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: DCNR-1

Associated with: CCI-000185

SV-38830r1_rule If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

Vulnerability discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

Check content

Check if the system is using LDAP authentication. #grep LDAP /etc/security/user If no lines are returned, this vulnerability is not applicable. Check if the useSSL option is enabled. #grep '^useSSL' /etc/security/ldap/ldap.cfg If yes is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server. #grep -I '^ldapsslkeyf' /etc/security/ldap/ldap.cfg If no line is found, this is a finding. List the certificate issuer with IBM GSK. #gsk7cmd -cert -list CA -db -pw Make note of the client Key Label. #gsk7cmd -cert -details -showOID -db -pw -label If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Fix text

Create a key database with DoD PKI or DoD-approved certificate. #gsk7cmd OR #ikeyman Edit /etc/security/ldap/ldap.conf and add or edit the ldapsslkeyf setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.