Check: GEN008000
AIX 5.3 STIG:
GEN008000
(in version v1 r3)
Title
If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI. (Cat II impact)
Discussion
LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.
Check Content
Check if the system is using LDAP authentication. #grep LDAP /etc/security/user If no lines are returned, this vulnerability is not applicable. Check if the useSSL option is enabled. #grep '^useSSL' /etc/security/ldap/ldap.cfg If yes is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server. #grep -I '^ldapsslkeyf' /etc/security/ldap/ldap.cfg If no line is found, this is a finding. List the certificate issuer with IBM GSK. #gsk7cmd -cert -list CA -db <certificate keyfile.kdb> -pw <Password> Make note of the client Key Label. #gsk7cmd -cert -details -showOID -db <certificate key.kdb> -pw <Password> -label <Key Label> If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.
Fix Text
Create a key database with DoD PKI or DoD-approved certificate. #gsk7cmd OR #ikeyman Edit /etc/security/ldap/ldap.conf and add or edit the ldapsslkeyf setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.
Additional Identifiers
Rule ID: SV-38830r1_rule
Vulnerability ID: V-22556
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000185 |
The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information. |
Controls
Number | Title |
---|---|
IA-5 (2) |
Pki-Based Authentication |